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Executive Summary 

In the spring of 2018, the Steamship Authority experienced three blackouts, a grounding, and a 
number of critical IT system outages. The resulting trip delays and cancellations, coupled with 
breakdowns in communication to the public, resulted in a public relations crisis and a call to 
action by the SSA’s governing Board on behalf of their constituents. This study is the response 
to that call. Following a public RFP process, HMS Consulting, Glosten, and Rigor Analytics 
were charged with performing a comprehensive review of SSA operations, with a focus on five 
subject areas: fleet maintenance, vessel operations, management structure, public 
communications, and IT systems. 

In July of 2018, a team of experts in these subject areas visited the SSA. The team conducted 
interviews with employees throughout the organization, observed vessel operations, and 
inspected the vessels, terminals, maintenance facilities, and IT infrastructure. Based on material 
gathered during and after the reconnaissance visit, the team utilized root cause analysis 
techniques to identify critical errors that directly and indirectly resulted in the incidents that led 
to the crisis. 

The goal of this study was to understand the underlying causes of the SSA’s failures to deliver 
on its public service commitments and develop recommendations for how to prevent similar 
incidents from occurring in the future. This executive summary describes the most critical areas 
for improvement that emerged from the investigation. 

Public Perception 

While public backlash was justified by the series of incidents in early 2018, it wasn’t due to a 
lack of commitment by the employees of the SSA to provide reliable service. This is deeply 
ingrained in the SSA’s culture. The problems in the spring of 2018 were despite this 
commitment to service. In fact, the organization excels in many areas that should be 
acknowledged. Unfortunately, the public perception is perhaps ill-informed and not properly 
managed. 

For example, the SSA’s budget is supported by operating revenues of approximately $100 
million annually. Since 1962, the SSA has had only four annual operating deficits, and it has not 
had to assess the taxpayers of the participating communities for monetary support since 1963. 
Impressively, the SSA has never relied on annual government subsidies. For a service that is 
mandated by legislation to provide critical services to the public, to not receive sizable financial 
support is extremely unique in the industry. Few public ferry services in the US, and globally for 
that matter, are able to achieve similar success while providing a quality service. This is an 
impressive accomplishment that is not fully understood or appreciated by the public they serve. 

Vision and Leadership 

A primary responsibility of an organization’s leadership is to manage the culture of the 
organization. This is accomplished by publicizing the organization’s vision, actively promoting 
it, and reinforcing it with actions. 

By contrast, the SSA does not actively publicize its mission, so it is left to interpretation by the 
workforce and the public’s perceptions of the actions of SSA leadership. For decades, the 
message from leadership has been narrowly focused on frugality. While fiscal responsibility is 
critical for an organization that operates without operating subsidies, it should not define what 
the organization aspires to accomplish. A broader vision may include financial aspects but 
should also seek to achieve the high quality and safe delivery of a service as primary objectives. 
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The lack of a clear and aspirational vision at the SSA has led to competing factions within the 
organization. This appears in regular interactions between various departments and individuals, 
resulting in different factions undermining and working against each other at the expense of the 
organization’s performance. 

The SSA’s leadership needs to develop a clear vision for the organization that will promote a 
more cohesive culture. This vision should be captured in an updated mission statement, which 
should be actively promoted to employees and the general public and reinforced with actions. 

Counter-Productive Frugality 

Perhaps in response to operating without subsidies, SSA management exhibits a level of 
frugality, or “penny pinching,” that hinders its ability to implement best practices and function 
properly. SSA’s frugality is based on admirable goals, but its overemphasis on cost reductions 
has been penny wise and pound foolish. 

Excessive frugality has resulted in understaffing across the organization, but especially in key 
technical roles within vessel operations and engineering. This has directly and indirectly 
contributed to vessel incidents. These incidents end up costing SSA due to unplanned 
maintenance and lost revenue. 

Understaffing of upper management is also problematic. SSA is over reliant on a small number 
of individuals who hold inordinate amounts of knowledge and power, resulting in an executive 
team that is stuck in a perpetual mode of day-to-day firefighting. The primary focus of these 
roles should be long-tenn sustainability and improvement of the organization, but almost no 
long-term planning is currently being perfonned. 

Smart investments in safety and quality will actually reduce overall costs, while improving 
public perception and employee morale. Investing in the most valuable asset, the employees, 
will become a force multiplier. Right-sizing management by adding key positions with critical 
skills will increase capabilities. Investing in a safety management system (SMS) and a high- 
quality enterprise asset management system will significantly reduce risk and liability, reduce 
unplanned downtime, and improve the efficiency of repairs. Restored trust in the system by both 
vessel crews and the general public will positively impact morale and revenue. 

Moving to a Process-Based Culture 

There are many latent issues with SSA operations that could result in future incidents. To 
prevent a repeat of the spate of incidents that instigated this study, or worse, it is necessary to 
evolve from a reactive culture to a process-based culture. 

The SSA operates almost entirely reactively, rather than actively identifying and attempting to 
mitigate risks. SSA standards for vessel operations and maintenance illustrate this culture, where 
the de facto standards for safety and quality assurance are the minimum requirements enforced 
by the US Coast Guard. Internal investigations of incidents and near misses are valuable 
learning opportunities and considered a best practice but are not required by these quality 
standards. 

Modern maritime organizations require processes and standards. This was identified in the 
formal investigation of the capsizing of the ferry M/V Herald of Free Enterprise on March 6, 
1987 which resulted in the death of 193 passengers and crew (Reference 8). In the investigation, 
the root cause was identified as a “disease of sloppiness” on the part of the vessel’s management. 
This assessment was centered on the company’s lack of process-based management. Since this 
incident, the industry has evolved significantly, but evidence suggests that the SSA has not. 
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Several key personnel at the SSA do not endorse this theory, as illustrated by the following 
quotes: 

• “We have operated this ferry system for years and years without problems like we had in 
the spring of 2018, and we will operate for years and years without any similar issues.” 

• “This was a perfect stonn of events.” 

• “There’s nothing broken here, it’s always worked.” 

But from our experience, this could not be further from the truth. 

The root cause analysis (RCA) performed on the March 17th MV Martha’s Vineyard blackout 
identified twenty-one individual issues with the vessel plant and the way it was operated. The 
net result of all of these issues was an unsafe condition on the vessel that led to the incident. 
While the blackout did not result in any serious casualties, had it occurred minutes later, while 
the vessel was maneuvering into the dock, the consequences could have been dire. 

Quality and safety processes inherent to most modern marine operations are designed to identify 
and correct issues before they manifest into a potentially unsafe condition. The identification 
and correction of just one of the twenty-one issues mentioned above may have prevented the 
incident entirely. Currently, there is no system in place at the SSA to accomplish this. The 
SSA’s reactive culture is designed to address the immediate cause, but not the root cause. 

Greater Accountability 

A lack of accountability for the perfonnance of the organization was observed within SSA 
management. Underperformance is being tolerated because the SSA lacks a system to 
adequately measure employee performance and the resolve to address obvious underperformers. 
SSA managers demonstrated the tendency to place blame for vessel incidents on individual crew 
members, rather than taking responsibility for the tools or systems they lack but require in order 
to succeed. 

Concluding that an incident is simply due to operator error is a missed opportunity to understand 
why the error occurred and how to improve system resilience so that future consequences of 
errors are minimized. The human element and mechanical failures can never be completely 
eliminated. It is management’s role to develop and maintain systems that minimize the 
occurrence of incidents, and the consequences of incidents when they do occur. 

The Board should be held accountable for developing and enforcing a strategic plan, and 
management should be held accountable for meeting the goals of the strategic plan. To invoke 
this accountability, managers should be evaluated on objective performance metrics and goals 
that are directly tied to the objectives of the strategic plan. 

Holding managers accountable to performance metrics based on a strategic plan will improve 
efficiency by aligning efforts, improving the allocation of human resources, and rewarding 
excellence while identifying and correcting underperformance. 

SSA frontline employees, including maintenance personnel and vessel crew, need to be given the 
tools to succeed, beginning with adequate training and equipment that is adequately maintained. 


Comprehensive Review of the Steamship Authority’s Operations 


3 


13 December 2018 




Section 1 Introduction 

1.1 Purpose of Study 

The Steamship Authority (SSA) is the primary ferry system providing service to the islands of 
Martha’s Vineyard and Nantucket from Cape Cod. In March and early April 2018, an 
unprecedented series of mechanical and operational problems occurred on the ferries, resulting in 
many unexpected trip cancellations. The events led to an erosion in public confidence and raised 
questions about the SSA’s vessel maintenance practices, fleet rotations, public communications 
and other aspects of its operations. 

The purpose of this study is to understand any systematic problems and organizational 
circumstances that allowed or encouraged the problems SSA experienced in the spring of 2018, 
and develop practical and effective recommendations that will reduce the chances of any such 
problems in the future. 

1.2 Scope of Study 

The scope of the study was limited to five areas of focus, as defined below: 

• Vessel operations. Vessel operations encompasses the management of the vessels: fleet 
scheduling and planning, support logistics, crew scheduling, policies, and procedures. It 
also includes onboard vessel operations, such as navigation, passenger management, deck 
operations, engineering, and standard operating procedures. 

• Fleet maintenance. The evaluation of fleet maintenance includes both planned and 
unplanned maintenance events. Planned maintenance events cover both the routine 
maintenance items performed by the SSA personnel and depot-level maintenance that is 
outsourced to contractors and shipyards. The evaluation also includes the methods by 
which the SSA determines maintenance requirements, how resources such as time, 
budget, and personnel training are allocated to conduct maintenance, and how the 
effectiveness of the SSA’s maintenance program is detennined. 

• Management structure. Management structure is defined as the relationship between 
organizational culture and organizational structure that results in the overall 
organizational climate. This relationship determines the effectiveness of management to 
perform well and meet its objectives. These three elements function in a similar fashion 
as gears in a machine, whereby if they don’t integrate the machine will not run properly. 
A review of the SSA’s management structure focuses on how well integrated these three 
elements are and the resulting performance of the organization. Additionally, this review 
looks closely at recent changes, how management has adapted and the effect they have 
had on its performance. 

• Information technology systems. The evaluation of IT Systems includes a complete 
review of the SSA’s IT architecture, including its website/reservation system, finance 
system, phone system, asset maintenance system, email or alert systems and how each 
system is integrated with the other, as well as the redundancy, security and 
hosting/reliability of each system. The SSA has purchased new financial and 
hardware/software recently and implemented redundancy and disaster recovery 
processes. Therefore, much of the review focuses on the integration of information, the 
collection and accuracy of the information, the ease of use and updating the information, 
and the timing or speed in which the information is disseminated to end users. 
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• Public communications. Public communications will be addressed in a supplemental 
document to this report. 

1.3 The Steamship Authority 

The Woods Hole, Martha’s Vineyard and Nantucket Steamship Authority’s statutory mission is 
to serve as the “Lifeline to the Islands” for everyone from year-round residents, who depend on 
the ferries for all commerce and transportation to and from the mainland, to a significant 
seasonal population, to the tourists who visit for a day, a week or longer. 

The Steamship Authority (SSA) is the primary ferry system providing service to the islands of 
Martha’s Vineyard and Nantucket from Cape Cod and the only service that carries vehicles. 
Established as an independent public authority in 1960, the authority is governed by a five- 
member board with representation from each island (Martha’s Vineyard and Nantucket) and the 
mainland communities of Falmouth, Barnstable, and New Bedford. The Port Council, a seven- 
member advisory board, consists of appointed members representing the municipal authorities of 
the following communities: Barnstable, Fairhaven, Falmouth, Nantucket, New Bedford, Oak 
Bluffs, and Tisbury. 

The SSA has its principle administrative offices in Falmouth, MA with ferry terminals in Woods 
Hole and Hyannis on Cape Cod, Vineyard Haven and Oak Bluffs on Martha’s Vineyard, and a 
tenninal on the island of Nantucket. They own and operate year-round parking lots in Woods 
Hole, Falmouth, and Hyannis and operate seasonal off-site parking lots in Falmouth, Bourne, and 
Hyannis. The SSA also has a vessel maintenance facility in Fairhaven and a receiving 
warehouse in Falmouth, and it rents property in Mashpee for its reservation office. 

The SSA currently services two primary routes; Woods Hole to Martha’s Vineyard (both 
Vineyard Haven and Oak Bluffs depending on schedule and season) and Hyannis to Nantucket. 
They operate a total of ten vessels carrying passengers, vehicles, and commercial freight trucks. 
These ten vessels include five passenger-vehicle ferries, four roll-on/roll-off freight vessels that 
carry a limited number of passengers and commercial trucks, and one high-speed passenger-only 
catamaran ferry. 

The SSA’s budget is supported by operating revenues of about $100 million. Since 1962, the 
SSA has had only four annual operating deficits, and it has not had to assess the taxpayers of the 
participating communities for monetary support since 1963. 

1.4 The Study Team 

The study team was made up of consultants from three firms; HMS Consulting and Technical, 
Glosten, and Rigor Analytics. The team consisted of subject matter experts, management 
consultants, IT consultants, marine engineers, and maritime professionals with experience in 
ferry system management. During the course of this independent study, the SSA provided 
documentation and information, but did not participate in the analysis or conclusions. 
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Section 2 Methodology 

This study focused on four primary areas of the SSA’s operations: vessel operations, fleet 
maintenance, management structure, and infonnation technology systems. The methods used in 
this study were designed to identify the most valuable recommendations to improve these areas 
of their operations. This was accomplished through a combination of data review, general 
observations by subject matter experts, and root cause analysis. 

2.1 Project Plan 

A formal project plan document, approved by the SSA as the project sponsor, was agreed upon 
and utilized to guide project execution, facilitate communication among stakeholders, and 
document the scope and schedule. This was done to align the goals of all parties and ensure a 
clear focus on the objectives throughout the project. 

The project planning process cooperatively established project objectives and measures for 
success before work on the project commenced. The organization of the project team was 
defined, and guidelines for decision making and managing conflict and change were established 
in writing. The project plan also contained communications protocols and project meeting 
schedules. 

2.2 Data Requests 

Data that was needed to perform analyses was requested from the SSA early in the project 
schedule. The SSA provided timely response to requests, allowing the study team to become 
familiar with SSA operations in advance of their site visit. Requested data included: 

• Paper records - logs, paper charts, correspondences, procedures, policies, administrative 
controls, etc. 

• Electronic records - procedures, policies, administrative controls, drawings, performance 
and operational data, analysis results, procurement specifications, etc. 

• People - discussions with employees, management, participants, etc. 

2.3 Site Visit and General Observations 

The project team performed a site visit during a five-day period from Monday July 23 rd through 
Friday July 27 th to make observations and gather data that could not be acquired remotely. One 
of the key objectives during the visit was to identify areas in which the SSA excels and what 
their key challenges are. General observations were made throughout the visit to gain insights 
regarding the culture at the SSA, general operating practices, and the underlying causes and 
impacts of recent incidents. 

Meetings and interviews were conducted with a broad cross-section of management, staff, front 
line workers, ship’s officers and crew, and members of the SSA’s Board and Port Council. 
Interview questions were developed in advance, incorporating the best available knowledge at 
the time of inception. During the meetings, additional inquiries were made as new information 
emerged. 

2.4 Root Cause Analysis 

This study utilized root cause analysis (RCA) to examine incidents with high potential learning 
value, particularly incidents that were likely to be representative of systemic problems across the 
organization. 
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The study team selected an RCA process derived from the American Bureau of Shipping (ABS) 
Marine Root Cause Analysis Technique (MaRCAT, Reference 2). In this technique, causal 
factors of marine incidents are identified and analyzed in order to identify the underlying root 
causes of the incidents. 

The objective of the RCA process is to identify where improvements in management systems 
could have prevented the causal factors from occurring. Even in instances where individual 
personal performance (the human element) or mechanical failures are identified as causal factors 
of an incident, this technique shows how the root cause of incidents is almost always the 
absence, neglect, or deficiencies of management systems. 

A review period was held with the SSA in order to verify the facts surrounding each incident 
investigated through the RCA process. This review was performed by conducting 
videoconferences with appropriate stakeholders identified by the SSA. The presentation 
included a synopsis of each event, demonstration of the causal chain of events, identification of 
the key causal factors, and a review of the root cause mapping process. Where necessary, facts 
were confirmed or reinvestigated. 

More information on the root cause analysis method is presented in Section 3.1. 

2.5 Development of Recommendations 

The methods described above provided the study team with two primary sources of data with 
which to identify challenges at the SSA. This in turn allowed the study team to develop a set of 
potential solutions for each challenge. 

Solutions to the problems identified by the RCAs are intended to provide systematic 
improvements that address the intennediate and root causes of each incident: 

• Intermediate solutions - Address the explicit reasons why a causal factor occurred, 
providing quick fixes, but do not address the root cause. 

• Root cause solutions - Address underlying deficiencies in management that allow causal 
factors to occur. Typically represent longer tenn efforts and results. 

Solutions were also developed to address problems identified from observations made during the 
reconnaissance and data collection process. 

The set of solutions from RCAs and General Observations were evaluated for conflicts, 
similarities, and synergies. This resulted in a subset of recommendations. 

Recommendations were then evaluated for their potential impact and ease of implementation. 
Impact represents the net benefit a recommendation has on the organization, in terms of 
overcoming one or more of the problems identified in our investigation. Ease of implementation 
measures how easily a recommendation can be implemented, based on cost, schedule, labor, and 
other potential barriers. 

The final recommendations presented in Section 5 are those which maximize impact and 
minimize barriers to implementation. 


Comprehensive Review of the Steamship Authority’s Operations 


7 


13 December 2018 




Section 3 Root Cause Analysis 


3.1 Introduction to the Root Cause Analysis Process 


The root cause analysis technique used by the study team is a structured approach to 
investigating events that was derived from ABS guidance and is a widely accepted standard 
across the marine industry (Reference 2). After selecting incidents for analysis and gathering and 
preserving the necessary data, a data analysis technique must be adopted. 


The analysis technique adopted for this study combines the ‘five-why’s’ technique with causal 
factor charting. Combined, this technique charts a chain of building blocks that establishes a 
timeline and the relationships between kn own events and conditions, as illustrated in Figure 1. 



No established 
procedures or guidelines 
or maneuvering protocols 
regarding approaching a 
sip. 




' and is not explicitly 
corroborated by other 
investigation inputs 

Alternate explanation is 
that main bridge station 
was inadvertently place 
into 'transfer lock' 


Throttle levers at wing 
were not matched to 
throttle levers at the main 
bridge console 




Figure 1 Sample causal factor building blocks 

Building blocks lead to causal factors, which include structure, machinery, equipment, outfitting, 
human errors, and external factors. Incidents may have multiple causal factors. 

Intermediate and root causes of the incident are derived from the causal factors using ABS’s root 
cause analysis map (see Appendix A). A given causal factor may take a single path through the 
map to lead to a root cause, or it may follow multiple paths leading to multiple intermediate and 
root causes. 


In the following sections, summaries of each root cause analysis are presented. Each summary 
provides a synopsis of the incident, identifies the causal factors, and illustrates how the causal 
factors were mapped to intermediate and root causes. Specific solutions are presented for each 
intennediate and root cause, and a concise list of both immediate solutions and root cause 
solutions is presented in Appendix B. Solutions to both the intermediate and root causes were 
used to inform the study’s Final Recommendations. 

In several cases it was not possible for the team to answer every question or determine the 
immediate cause of equipment failures. However, the focus of a root cause analysis is to 
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determine the failures in management systems which allowed for the immediate cause to have a 
negative impact. While it would be nice to know why a particular piece of equipment failed or a 
decision was made, the true value of root cause analysis is to identify how that failure could have 
been sustained without it resulting in an incident. In each case, the team was successful in 
accomplishing this. 

3.2 March 15 th Grounding of the M/V Woods Hole 

On March 15, 2018 at approximately 9:30 am, upon approach to Vineyard Haven Slip #1, the 
M/V Woods Hole experienced a temporary loss of main propulsion engine control that resulted 
in a soft grounding of the bulbous bow. 

Upon approach to the slip, the captain initiated a final maneuver to reach alignment from the 
main bridge controls. In the middle of the maneuver, the bridge crew attempted to transfer 
control to the starboard wing station. The pilot/mate initiated transfer by going out to the wing 
station to take control. The pilot/mate reported to the captain that he was unable to take control 
on the bridge wing. At that point, the captain, at the main bridge console, was also unable to 
retake control. The captain notified the chief engineer (who was stationed in the Engine Control 
Room) to take control locally and attempt to resend it back to the main bridge console. The chief 
engineer did so with success, and the captain was able to regain control at the main bridge 
console. By this time, the vessel’s bulbous bow had a soft grounding. The vessel was then able 
to continue into the slip without further issues. 

The main propulsion controls are a newer system from Prime Mover Controls (PMC) with which 
the crew had limited experience and had never received formal training . 

The chain of events is based on information provided by vessel crew through written statements 
and verbal discussions. Additional discussions were held with technical representatives from 
PMC and engineering staff. Unfortunately, the M/V Woods Hole is not equipped with a Voyage 
Data Recorder (VDR), which may have provided additional insight as to the cause of the failure 
to transfer control. Therefore, it was not possible to definitively determine the cause of the 
immediate failure of the main propulsion control system. The most likely immediate cause (not 
a causal factor) was a failure of the control system itself, which could not be replicated or 
verified by PMC technicians, or operator error. While the cause could not be confirmed, the 
immediate cause was found to be irrelevant to the root cause of the incident. 

The root cause analysis of this event resulted in the causal factor chart illustrated in Appendix A, 
and identification of the following causal factors: 

Causal Factor #1: Overreliance on institutional knowledge. 

Causal Factor #2: Insufficient training on new equipment. 

Causal Factor #3: No established procedure. 

Causal Factor #4: No process to communicate a potential problem. 

Determinations of root causes for these causal factors are described below. 

3.2.1 Causal Factor #1: Overreliance on Institutional Knowledge 

Control transfer was initiated in close proximity to the slip with no established procedures, 
guidelines, or protocols for maneuvering in a way to mitigate risk posed by equipment failures or 
human error. The experience of the crew was considered a substitute for risk identification and 
training. Guidelines on vessel maneuvering should identify potential risks, including mechanical 
failures and operator errors, and ensure vessel maneuvers are initiated in such a way as to 
mitigate these risks. In this particular case, if the attempt to transfer control had been initiated 
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prior to reaching a ‘point of no return’, an opportunity to recover from a failure in the system 
would have been provided. As it was, regardless of the cause of the transfer failure, by the time 
control was reestablished it was too late to avoid a grounding. Rather than a procedure or 
guidelines, the SSA relied solely on the experience of their vessel operators without taking into 
account that the control system had been changed in the recent repair period. 

This causal factor follows multiple paths when mapped to the root causes: 

Root Cause Mapping: Overreliance on Institutional Knowledge (a) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) relied 
on their experience in the organization rather than 
training and therefore did not recognize the need for 
training. 

Problem 

Category 

Company Employee (12) 

The individuals responsible for identifying training 
needs were company employees. 

Cause 

Category 

Training Personnel 
Qualifications (178) 

Sufficient training was not provided to successfully 
perform the task. 

Cause Type 

No Training (179) 

No decision was made to identify training 
requirements. 

Intermediate 

Cause 

Training Need Not 
Identified (183) 

The grounding event wrongly served to identify the 
training need. A memo was distributed after the event 
entitled “ME Woods Hole Captains Training 

Checklist” that included a successful demonstration of 
PMC Control Station Transfers. 

Solution to 

Intermediate 

Cause 

A risk assessment for approaching and departing each terminal should be 
performed, identifying potential risks, and providing a means to mitigate each 
identified risk. 

Root Cause 
Type 

SPACS Issue (256) 

SPACs inadequate, confusing, incomplete, or unclear. 

Root Cause 

SPAC / Confusing 
Contradictory or 
Incomplete (259) 

SPACs not specific enough 



Root Cause Mapping: Overreliance on Institutional Knowledge (b) 


Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) relied on 
their experience in the organization and did not identify the 
risks associated with the task. 

Problem 

Category 

Company Employee (12) 

The individuals responsible for identifying risks were 
company employees. 

Cause 

Category 

Human Factor (143) 

The capabilities and limitations of the individuals involved 
were not considered in the design and development of the 
control system. 
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Root Cause Mapping: Overreliance on Institutional Knowledge (b) 

Category 

Mapping 

Description 

Cause Type 

Situational Awareness 
(150) 

The crew was not aware of the risk potential associated 
with transferring control in close proximity to fixed objects. 

Intermediate 

Cause 

Knowledge Based 
Decision Required (157) 

Personnel had to make decisions based on specific 
knowledge of the system for a successful outcome, but no 
procedure existed and no one else on board had a sufficient 
level of experience with the system. 

Solution to 

Intermediate 

Cause 

Tools such as decision trees, job risk assessments and flow charts should be provided to 
aid decision making. Unusual events should be used as a learning and training tool. 
Personnel should be trained to use the information they are provided. 

Root Cause 
Type 

SPACS issue (256) 

SPACs inadequate, confusing, incomplete, or unclear. 

Root Cause 

SPAC / Confusing 
Contradictory or 
Incomplete (259) 

SPACs not specific enough 


Root Cause Mapping: Overreliance on Institutional Knowledge (c) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) relied on 
their experience in the organization and did not identify the 
unique, vessel specific training needs associated with the 
equipment on board the vessel. 

Problem 

Category 

Company Employee 
(12) 

The individuals responsible for identifying these training 
needs were company employees. 

Cause 

Category 

Training Personnel 
Qualifications (178) 

The training was not sufficient to perform the task. 

Cause Type 

Training Issue (187) 

The task was not analyzed, and no testing was performed to 
measure the ability of the crew to perform the task. 

Intermediate 

Cause 

Training Program 
Design Objectives 
Issue (188) 

The existing training design does not include vessel specific 
familiarization procedures. The SSA’s Pilot Training 

Manual addresses route familiarization but not vessel 
familiarization. The “Operations and Safety Manual” 
(published in 1997) includes an operational checklist 
entitled “Familiarization with Bridge Equipment “and a 
“New Crewmember Orientation Checklist”. The checklists 
are not vessel specific, they do not address transfer control 
and there is scanty evidence that the 1997 manual is in use. 

Solution to 

Intermediate 

Cause 

The training needs for deck officers should be analyzed, and training criteria and 
curriculum should be established based on those needs. 

Root Cause 
Type 

SPACS Issue (256) 

SPACs inadequate, confusing, incomplete, or unclear. 

Root Cause 

SPAC / Not Strict 
Enough(258) 

SPACs not specific enough 
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3.2.2 Causal Factor #2: Insufficient Equipment Training 

SSA management assumed that the task of understanding the transfer of control on the new 
system was a skill that would be gained through experience. As a result, risks were not 
identified and training procedures were not developed. 


Root Cause Mapping: Insufficient Training on New Equipment 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human( s) did not 
identify the training needs on new equipment associated 
with the transfer of control to the wing stations. 

Problem Category 

Company 

Employee (12) 

The individuals responsible for identifying training needs 
were company employees. 

Cause Category 

Training / 

Personnel 

Qualifications 

(178) 

The training was not sufficient to perform the task. 

Cause Type 

No Training (179) 


Intermediate Cause 

Decision Not to 
Train (180) 

No decision was made to identify training requirements 
because the risks were not well understood. 

Solution to 
Intermediate Cause 

The hazards of the process and tasks associated with approaching a dock or 
pier under normal operations, non-routine operations, and emergency 
operations should be identified. 

Root Cause Type 

SPACS Issue 
(256) 

SPACs inadequate, confusing, incomplete, or unclear. 

Root Cause 

No SPAC / Issue 
Not Addressed 
(257) 

SPACs not specific enough. 

3.2.3 Causal Factor #3: Lack of Established Procedures 

A vessel-specific transfer control procedure did not exist at the time of the incident. 

Root Cause Mapping: 

No Established Procedure 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) did not 
consider the importance of having a written procedure 
for the task. 

Problem Category 

Company 

Employee (12) 

The individuals responsible for identifying the need for 
procedures on new equipment in order to maintain 
operational discipline were company employees. 

Cause Category 

Procedures (120) 

No procedure to perform the task existed. 

Cause Type 

Not Used (121) 



Intermediate Cause No Procedure for 
task or operation 
( 122 ) 


Solution to 
Intermediate Cause 

A procedure should be developed for transfer control. All modes of operation 
and maintenance procedures should be addressed. 

Root Cause Type 

SPACS Issue SPACs inadequate, confusing, incomplete, or unclear. 

(256) 
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Root Cause Mapping: 

No Established Procedure 

Category 

Mapping 

Description 

Root Cause 

No SPAC / Issue 
Not Addressed 
(257) 

No SPAC existed for the situation involved. 

3.2.4 Causal Factor #4: No Communication Process 

The new control system was not well understood by the crew and there was no means to 
communicate this problem to management in order to seek a remedy. 

Root Cause Mapping: No Process to Communicate the Problem 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) knew that 
the control system was not well understood by crew 
members responsible for operating it and did not 
communicate the issue to management because there was 
no established protocol to do so. 

Problem Category 

Company 

Employee (12) 

The individuals responsible for ensuring positive two- 
way communication between the crew and management 
were company employees. 

Cause Category 

Human Factor 
(143) 

Crew understood a training deficit existed but there was 
no formal means of reporting and tracking these 
observations to management. 

Cause Type 

Problem 

Identification and 
Control Issue (89) 

Intermediate Cause 

Problem Reporting 
Issue (90) 


Solution to 
Intermediate Cause 

A simple method should be established for vessel personnel to provide 
suggestions and feedback to shore management. Event reporting guidelines 
should be developed and vessel crews should be trained on the types of events 
that should be reported. 

Root Cause Type 

SPACS issue (256) 

SPACs inadequate, confusing, incomplete, or unclear. 

Root Cause 

No SPAC / Issue 
Not Addressed 
(257) 

No SPAC existed for the situation involved. 
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3.2.5 Solutions to Root Causes - March 15 th Grounding of the M/V Woods 
Hole 


Causal Factor 

Solutions 

1(a). Overreliance 
on Institutional 
Knowledge 

Solicit comments and recommendations from operations and 
maintenance personnel regarding the proper function and operation of 
the transfer control system and resolve each comment. Utilize all 
available information and knowledge to establish vessel specific 
instructions regarding how to properly transfer control. Incorporate 
these instructions into a vessel specific training and familiarization 
program that addresses recency. 

1(b). 

Provide adequate staffing with the necessary knowledge and 
experience. 

1(c). 

Improve the level of detail in all training material. Provide vessel 
specific familiarization procedures that includes physical demonstration 
if competencies. 

2. Insufficient 
Training on New 
Equipment 

Compile a list of vessel specific procedures and compare them to the 
existing list. Define and document any missing procedures and 
communicate them to fleet. 

3. No Established 
Procedure 

Establish a system of document control that clearly indexes the current 
library of procedures. OEM manuals do not replace vessel specific 
procedures. 

4. No Process to 

Communicate 

Problem 

Develop an enhanced reporting process to ensure risk recognition, share 
recognized hazards and gather data. 


3.3 Delays to M/V Island Home Return to Service 

In the winter and spring of 2018 the M/V Island Home went through an overhaul and repair 
period which began at a local shipyard and ended at the Fairhaven repair facility. The Island 
Home was scheduled to return to service on March 24 th but was delayed a total of 12 days and 
did not return to service until April 5 th . While delays are common in shipyard periods, in this 
case in particular the impact was felt throughout the system as other vessels were out of service 
for mechanical and other reasons, stretching the capacity of the system. 

On October 23, 2017 the contract for repair work on the M/V Island Home was awarded to 
Senesco Marine for a planned haul-out on January 12, 2018. The scope of work included 
standard drydock items such as hull cleaning, preparation and painting, sea valves, shafts and 
seals, propellers, rudders, as well as allowances for potential discovery items such as hull plating 
replacement. In addition to standard overhaul items, there were a few projects which would 
require additional planning and close coordination between the shipyard and the SSA. These 
projects included the replacement of the bow thruster prime movers (converting from 
electrically-driven to diesel engine-driven), a critical system. 

The bow thruster project became the critical path of the repair schedule due to delays in that 
specific project. These delays eventually resulted in late delivery of the M/V Island Home into 
service. While this is obvious in hindsight, it may not have been obvious during the course of 
the project because a project schedule did not exist. While it is normally considered best practice 
to develop, monitor and maintain a project schedule in a GANTT chart format which identifies 
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the critical path, it was not a requirement in the contract with Senesco Marine and one was not 
provided. 

Between contract award and delivery of the M/V Island Home to the shipyard, a period of 
approximately 80 days, a considerable amount of planning, procurement of long lead time items 
and coordination between the contractor, their subcontractors and the SSA was necessary. 
Typically, a key step to this coordination is to convene a kick-off meeting including all relevant 
parties. This would allow the project team to confirm the scope of work, identify risks to the 
project (such as long lead time items), define quality assurance expectations, and confirm 
engineering and procurement responsibilities, among other things. However, a kick-off meeting 
was not held and formal communication between parties could not be confirmed. 

In accordance with the contract, the M/V Island Home was delivered to the shipyard on January 
12 th . On the same date, the bow thruster engine gears, which were owner furnished equipment 
(OFE), were also delivered to the shipyard. Other components of the bow thruster project were 
the responsibility of the shipyard to procure. Of these, the gear couplings were ordered late and 
the prime mover engines were delivered late. Reasons for these delays are unknown, but both of 
these lapses created delay in the schedule (without a project schedule it is difficult to identify the 
exact impact). 

Routine repair projects were completed by the shipyard without notable delays or impacts to the 
overall schedule. Upon delayed receipt of the bow thruster engines on February 7 th , it was 
discovered that the engine foundations which had been fabricated by Senesco according to 
drawings provided by the engine manufacturer did not fit the engines and would require rework. 
This event introduced additional delay on the critical path. 

On March 9 th , the M/V Island Home departed the shipyard for the Fairhaven repair facility. All 
routine work was complete at this time, including some additional work items introduced via 
discovery (a typical occurrence in drydockings) and addressed with change orders. The bow 
thruster project and some topside painting was not complete at this time. Senesco planned to 
mobilize their team (including their subcontractors) to Fairhaven to complete these outstanding 
tasks. This was approximately 15 days past the planned departure. As delays in shipyard are 
common, the practice of follow-up dockside repair work in Fairhaven provides the SSA with 
flexibility to adjust the work performed in order to meet the schedule for returning vessels to 
service. In this particular case, the scope of work at Fairhaven was adjusted but the bow thruster 
project remained the critical path overall and extended the delay past the planned departure from 
Fairhaven. 

Work on the bow thruster project at Fairhaven continued through the month of March. A US 
Coast Guard inspection scheduled for March 29 th was cancelled as initial testing on the prime 
movers identified issues with the control system. Further testing proved successful and the 
USCG attended testing on April 3 rd , at which point several issues with bridge controls of the 
system were identified. These issues were addressed by technicians and on April 5 th the USCG 
returned for testing and trials and cleared the vessel for service. Later that day the M/V Island 
Home entered revenue service. 

Root cause analysis of this event resulted in the causal factor chart illustrated in Appendix A and 
identification of the following causal factors: 

Causal Factor #1: Management of project not fully defined. 

Causal Factor #2: Inability to accurately track progress against a project schedule, specifically 
the critical path. 

Causal Factor #3: Ongoing monitoring (quality control) of shipyard’s activities was inadequate. 
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Determinations of root causes for these causal factors are described below. 


3.3.1 Causal Factor #1: Lack of Project Management Definition 

When the contract for the drydocking and repairs of the M/V Island Home was awarded to 
Senesco Marine, there were approximately 80 days until the vessel was to be delivered. The 
scope of work contained several projects that were not routine and would require careful 
planning and coordination between the SSA, Senesco and their subcontractors, in particular the 
bow thruster project. This project alone was particularly complex because there were 
components and engineering required to be provided by both the SSA (as OFE) and Senesco, 
rather than one party being fully responsible for the entire project. The SSA engineering team 
failed to identify the risks associated with this complexity and develop a project plan which 
would define all aspects of the project, including responsibilities, expectations, communications 
protocols, scheduling, procurement, and quality assurance. A kick-off meeting with Senesco and 
the subcontractors was not held to communicate these critical aspects of the project to all and 
confirm all parties were in agreement and mutual understanding. 

Fully defining the management of the project would have clarified any questions or doubts 
among Senesco, their subcontractors and the SSA project team. It is likely this would have 
prevented missteps by the team, such as Senesco’s failure to order critical components on time, 
inaccurate drawings being utilized, or testing failures. 


This causal factor follows multiple paths when mapped to the root cause(s). 


Root Cause Mapping: Management of Project Not Fully Defined (a) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that human(s) did not take 
proper steps to coordinate with contractors and define 
responsibilities, scope of work and project schedule. 

Problem 

Category 

Company Employee 
(12) 

The individuals responsible for defining the project were 
company employees. 

Cause 

Category 

Procedures (120) 

A process or procedure for defining the project was 
necessary to guide company employees. 

Cause Type 

Not Used (121) 

A procedure was not used. 

Intermediate 

Cause 

No Procedure for 
Task / Operation 
(122) 

The lapses in management of the project by both company 
employees and contractors were due to not fully defining 
the project itself. The company did not have a procedure for 
this task, to provide guidance on fully defining an overhaul 
project from its outset. 

Solution to 

Intermediate 

Cause 

A Project Plan should be developed for the proper and full definition of any major 
repair project. All parties should participate in a kick-off meeting to review the 
plan and confirm its definition. 

Root Cause 
Type 

SPACS Issue (256) 

The issue was not identified and therefore no SPACs 
existed to address it. It was apparent that the management 

Root Cause 

No SPACs / Issue 

Not Addressed 
(257) 

of routine overhauls and repairs is based solely on 
institutional knowledge with no established process to 
address project management by a team, such as developing 
and communicating a project plan. 
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Root Cause Mapping: Management of Project Not Fully Defined (b) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that human(s) did not take 
proper steps to coordinate with contractors, define 
responsibilities, scope of work and project schedule. 

Problem 

Category 

Company Employee 
(12) 

Permanent Officers 
(10) 

Third Party (13) 

The individuals responsible for defining the project were 
company employees. 

Cause 

Category 

Responsibility / 
Authority (200) 

The responsibility and authority of individuals involved in 
the project should be clearly defined and established in 
writing to avoid confusion. 

Cause Type 

Responsibility / 
Authority Not 
Defined (201) 

The Owner’s project team was loosely defined. 
Responsibilities and authority were based on past 
experiences and not clearly established. Responsibilities of 
contractors were not confirmed. 

Intermediate 

Cause 

Responsibility / 
Authority Not 
Defined (201) 

A critical part of defining a project is to clearly define the 
responsibilities and authority of all parties involved in order 
to avoid confusion and hold team members accountable. 

Solution to 

Intermediate 

Cause 

In developing a project plan, all responsibilities and authority should be clearly 
defined. Communicate to all parties in order to confirm and address any conflicts. 

Root Cause 
Type 

SPACS Issue (256) 

The issue was not identified and therefore no SPACs 
existed to address it. Although the engineering managers 

Root Cause 

No SPACs / Issue 

Not Addressed 
(257) 

and senior vessel crew members have extensive experience 
with routine overhauls and repair projects, without clearly 
defined roles and responsibilities there is a high risk of 
miscommunication and failures of individuals, contributing 
to unnecessary delays or additional costs. 


3.3.2 Causal Factor #2: No Project Schedule Tracking 

For any project there are four basic elements that must be monitored, adjusted, and balanced in 
order to ensure success: scope of work, quality of work, cost, and schedule. For any given 
project these elements are prioritized in order to aid the project team in decision-making. For the 
M/V Island Home overhaul period in general and the bow thruster project in particular, schedule 
should have been a priority, considering the demand placed on the vessels in preparation for the 
busy season. This cannot be definitively affirmed at this time without a project plan, but it was 
implied by a liquidated damages provision contained within the contract. A critical provision 
which the contract did not contain was a requirement for the prime contractor to provide a 
project schedule. Without a project schedule it is impossible to accurately monitor progress and 
the impact of delays. 


Root Cause Mapping: Project Schedule 


Category Mapping 

Description 

Problem Human (4) 

The nature of the problem was that a human(s) did not 
identify the need for a project schedule. 
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Root Cause Mapping: 

Project Schedule 


Category 

Mapping 

Description 

Problem Category 

Company 

Employee (12) 

The individuals responsible for identifying the need were 
company employees. 

Cause Category 

Procedures (120) 

The problem was caused by the lack of a policy or 
procedure for requiring a project schedule to be 
developed for any project over certain thresholds. 

Cause Type 

Not Used (121) 

A procedure was not used. 

Intermediate Cause 

No Procedure for 
Task / Operation 
(122) 

The inability of the project team to accurately forecast 
delivery, track progress, and make adjustments was due 
to the lack of a project schedule identifying a critical 
path. 

Solution to 
Intermediate Cause 

Develop a policy to require that all projects over certain thresholds have a 
project schedule which identifies the critical path. Monitor and update the 
schedule regularly. 

Root Cause Type 

SPACS Issue 
(256) 

The issue was not identified and therefore no SPACs 
existed to address it. The lack of a policy requiring a 

Root Cause 

No SPAC / Issue 
Not Addressed 
(257) 

project schedule, whether provided by the contractor or 
developed by the SSA project team, contributed to the 
project team’s inability to accurately track progress, and 
identify the impact of delays. 


3.3.3 Causal Factor #3: Insufficient Shipyard Management 

Even for the most routine overhaul projects it is necessary to monitor the activities of the 
contractor(s). Complex projects require additional oversight. Shipyards may perform some level 
of quality control and project management, but none should be assumed. Even if they do, the 
shipyard’s priorities are not always aligned with their clients. Monitoring of a shipyard project 
necessitates more than simply having personnel on site. Due to the lack of a project plan, a 
project schedule and routine project meetings, personnel on site were unable to perform adequate 
monitoring. 


This causal factor follows multiple paths when mapped to the root cause(s). 


Root Cause Mapping: Quality Control (a) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) 
underestimated the need for monitoring of the contractor. 

Problem Category 

Company 

Employee (12) 

The individuals responsible for identifying the need were 
company employees. 

Cause Category 

Procedures (120) 

A policy or procedure for establishing minimum 
monitoring of contractors. 

Cause Type 

Not Used (121) 

A procedure was not used. 

Intermediate Cause 

No Procedure for 
task or operation 
(122) 

Inadequate monitoring of the shipyard’s progress 
contributed to delays and inappropriate responses or 
adjustments. 

Solution to 
Intermediate Cause 

Develop a policy or procedure identifying required levels of project 
monitoring, based on specific thresholds. 

Root Cause Type 

SPACS Issue 
(256) 

The issue was not identified and therefore no SPAC 
existed for the situation. As the level of monitoring of 
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Root Cause Mapping: Quality Control (a) 

Category 

Mapping 

Description 

Root Cause 

No SPAC / Issue 
Not Addressed 
(257) 

the shipyard was inadequate, several missteps on the 
shipyard’s part were not identified in time to prevent 
them, resulting in delays. 


Root Cause Mapping: Quality Control (b) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) 
underestimated the need for monitoring of the contractor. 

Problem Category 

Company 

Employee (12) 

The individuals responsible for identifying the need were 
company employees. 

Cause Category 

Training / 

Personnel 

Qualifications 

(178) 

Training was not provided to project team. 

Qualifications were not established. 

Cause Type 

No Training (179) 


Intermediate Cause 

Training Need Not 
Identified (183) 

Training for project team was not provided and 
necessary qualifications were not determined in order to 
ensure team was prepared or equipped to perform 
adequate monitoring of the shipyard. 

Solution to 
Intermediate Cause 

Develop a policy identifying necessary qualifications required of project team 
and provide adequate training where identified. 


The issue was not identified and therefore no SPAC 
existed for the situation. Without the proper 
qualifications or training, the project team was unable to 
perform adequate quality control of the shipyard’s work 
and progress. 


3.3.4 Solutions to Root Causes - Delays to M/V Island Home Return to 
Service 


Causal Factor 

Solutions 

1(a). Management 
of Project Not 

Fully Defined 

Develop a Project Plan template to be used for all projects meeting or 
exceeding certain thresholds, such as capital value or complexity. 
Establish a policy requiring a project plan and basic levels of 
documentation and communications commensurate with the specific 
project. 

1(b). 

Clearly define the roles and responsibilities of every team member 
involved in an overhaul project. Identify authority levels and decision¬ 
making protocols. Communicate these with all parties involved, 
including contractors and subcontractors. 

2. Project 

Schedule 

Develop a policy requiring a project schedule with specific 
requirements (i.e. critical path identified) be developed for all projects 
exceeding certain thresholds. Ensure that the project schedule is 
updated on a predetermined frequency, changes or delays are 


Root Cause Type SPACS Issue 

_(256)_ 

Root Cause No SPAC / Issue 

Not Addressed 
(257) 
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Causal Factor 

Solutions 

communicated to the project team and adjustments are made when 
necessary. 

3(a). Project 
Monitoring 

Develop a policy and supporting procedures which identify project 
monitoring requirements. Ensure that proper resources and personnel 
are provided to accomplish the necessary level of monitoring. 

3(b). 

Develop a policy to ensure all project team personnel are trained in 
project management disciplines and meet the proper qualifications for 
individual responsibilities as assigned. Designated project managers 
should receive formal project management training. 


3.4 March 17 th Blackout of M/V Martha’s Vineyard 

On March 17 th , 2018, an improperly attached starter wire on Generator #3 caused the electrical 
plant of the M/V Martha's Vineyard to black out. The blackout was accompanied by a small fire 
at the generator which was handled by vessel crew. Following the incident, the crew put 
Generator #1 and Generator #2 online and restored the plant. The USCG attended and allowed 
the vessel to proceed with passenger operations based on the availability of the other two 
generators. When restoring the plant on Generator #1 and Generator #2, the crew did not start 
the fuel oil transfer pump, which maintains the fuel service ta nk in a full state. The level in the 
fuel oil service tank dropped throughout the day until all engines shut down from lack of fuel, 
while the vessel was approximately 15 minutes into a trip to Woods Hole from Vineyard Haven. 
No low fuel level alarm was annunciated by the vessel automation and the vessel crew failed to 
notice the dropping fuel level throughout the day. 

Root cause analysis of this event resulted in the causal factor chart illustrated in Appendix A, and 
identification of the following causal factors: 

Causal Factor #1: The fuel pump was not restarted when restarting the vessel plant. 

Causal Factor #2: A formal evaluation of the initial blackout casualty was not perfonned. 

Causal Factor #3: Changes to the vessel configuration were not adequately conveyed to 
management and circulated with crew. 

Causal Factor #4: The periodic safety test procedure did not include tests it should have. 

Causal Factor #5: There was inadequate testing of the vessel prior to returning the vessel to 
service. 

Determinations of root causes for these causal factors are described below. 

3.4.1 Causal Factor #1: Fuel Pump not Restarted with Plant 

Fuel for the main engines and generators is pulled from a fuel oil service tank. A fuel transfer 
pump continuously transfers fuel from the storage tank to the service tank. The fuel transfer 
pump is intended to be always on. The service ta nk overflow pipe is routed back to the storage 
tank, such that if the service tank is full, the excess fuel transferred from the storage tank to the 
service ta nk is returned to the storage tank. 

The startup procedure for M/V Martha’s Vineyard includes starting the fuel transfer pump. In 
this incident, some vessel auxiliary machinery was restarted, but the fuel transfer pump was not 
restarted. Eventually, this led to a complete depletion of the service tank. If the standard vessel 
startup procedure had followed the blackout, the incident would not have occurred. 
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This causal factor follows multiple paths when mapped to the root cause. 


Root Cause Mapping: Fuel Pump Not Restarted (a) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human (the vessel 
crew) did not restart the fuel transfer pump following 
blackout. 

Problem Category 

Permanent Crew 
(10) 

The crew who were responsible for restoring power to 
the vessel after blackout and did not restart the pump 
were permanent SSA vessel crew. 

Cause Category 

Procedures (120) 

There was no standard operating procedure for how to 
- restore normal operation of the vessel after a blackout. 

Cause Type 

Wrong / 

Incomplete (135) 

Intermediate Cause 

Incomplete / 
Situation Not 
Covered (141) 

Although there was a procedure for starting the vessel 
from deadship that includes starting the fuel transfer 
pump, there was not a checklist for ensuring normal 
operation of the vessel after startup from any condition, 
including restart from a blackout. 

Solution to 
Intermediate Cause 

The vessel should have a checklist for normal operation after startup. 

Root Cause Type 

SPACs Issue (256) 

Inadequate company policies, procedures, and checklists 
for how to ensure continuous, normal operation of the 
vessel contributed to the occurrence of this incident. 

Root Cause 

SPACs Confusing, 
Contradictory, or 
Incomplete (259) 

At the root of this causal factor was a lack of standard 
vessel operating procedures to ensure continuous, normal 
operation of the vessel. Such operating procedures are 
particularly important for ensuring recovery from 
unusual events, such as an unexpected plant blackout. 



It was observed that vessel procedures and checklists 
generally only targeted and were utilized by new vessel 
crew, whereas experienced crew relied on their 
experience and memory. Certain critical “catch-all” 
checklists should be implemented as part of company 
policy. 


Root Cause Mapping: Fuel Pump Not Restarted (b) 


Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human (the vessel 
crew) did not restart the fuel transfer pump following 
blackout. 

Problem Category 

Permanent Crew 
(10) 

The crew who were responsible for restoring power to 
the vessel after blackout and did not restart the pump 
were permanent SSA vessel crew. 
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Root Cause Mapping: Fuel Pump Not Restarted (b) 

Category 

Mapping 

Description 

Cause Category 

Training/Personnel 

Qualifications 

(178) 

The crew members were not trained to ensure normal 
operation of the vessel in the event of restarting due to a 
plant blackout. Following the normal startup procedure 
would have resulted in the fuel pump being restarted. 

Cause Type 

No Training (179) 

Crew were not trained on a procedure to follow to ensure 
normal operation of the vessel after restarting the plant. 

Intermediate Cause 

Training Need Not 
Identified (183) 

Vessel management did not recognize the need to train 
its crew to utilize checklists to ensure normal operation 
of the vessel after starting the plant. 

Solution to 
Intermediate Cause 

The crew should be trained to run through a checklist to ensure normal 
operation of the vessel after any start or restart of the vessel’s plant. 

Root Cause Type 

SPACs Issue (256) 

Inadequate company policies, procedures, and checklists 
for how to ensure continuous, normal operation of the 
vessel contributed to the occurrence of this incident. 

Root Cause 

SPACs Confusing, 
Contradictory, or 
Incomplete (259) 

At the root of this causal factor was the lack of 
management system policies governing training at the 

SSA. More specifically, the SSA is lacking crew 
training on procedures for how to ensure normal 
operation of the vessel at any given point in time. 

It was observed that vessel procedures and checklists 
generally only targeted and were utilized by new vessel 
crew, whereas experienced crew relied on their 
experience and memory. 


3.4.2 Causal Factor #2: Formal Evaluation of Initial Blackout Casualty Not 
Performed 

After the crew extinguished the fire and restored power to the plant by placing Generators #1 and 
#2 online in parallel, the USCG was notified of the incident. The USCG issued a CGForm835 
identifying a deficiency for Generator #3 but allowed the vessel to return to service based on the 
availability of two working generators and the assumption that all other systems were operating 
normally. In fact, the vessel was not operating normally. In addition to undetected damage to 
certain systems, fuel was being depleted from the service tank but not being refilled from the 
storage tank because the fuel transfer pump had not been restarted. 

A formal and thorough process for completing incident investigations would have identified all 
the consequences of the plant blackout, including that the fuel transfer pump was offline and 
required a restart. The SSA relied on institutional knowledge of its vessel crew to return the 
vessel to nonnal operation. An opportunity to recognize that the vessel was not operating 
normally was missed, which eventually led to the incident. 
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Root Cause Mapping: Incident Evaluation Not Performed 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that humans (SSA Management) 
did not develop or institute policies requiring investigations of 
incidents. 

Problem Category 

Company 

Employee 

(12) 

Development of policies is the responsibility of management. 

Cause Category 

Procedures 

(120) 

If an adequate procedure for conducting an incident investigation 
had been in place and utilized, the abnormal operation would 
have been identified. 

Cause Type 

Not Used 
(121) 

An adequate procedure for conducting an incident investigation 
was not used. 

Intermediate 

Cause 

No 

Procedure 
for Task / 
Operation 
(122) 

There was no standard procedure for conducting an incident 
investigation. 

Solution to 
Intermediate 

Cause 

A standard operation procedure for conducting thorough incident investigations 
should be developed, to ensure all systems are operating normally, identify 
remedial actions, and immediately begin data collection that may be helpful in 
identifying any persistent, hidden issues. 

Root Cause Type 

SPACs 

Issue (256) 

Inadequate company policies, procedures, and checklists for how 
to ensure continuous, normal operation of the vessel contributed 
to the occurrence of this incident. 

Root Cause 

No SPAC / 
Issue Not 
Addressed 
(257) 

At the root of this causal factor was the lack of company policies 
for conducting thorough investigations immediately after 
incidents or near misses occur. 


3.4.3 Causal Factor #3: Vessel Configuration Changes Not Communicated 

Fuel is pumped to the main engines and generators at a constant rate, and any excess fuel not 
demanded by the engines is returned to fuel tanks through return fuel piping. Valving allows the 
crew to direct the return fuel to either the storage tank or the service tank. When the service tank 
is full and the fuel return is directed back to the service tank, the service tank will provide 
enough fuel for more than a normal operating day without the fuel transfer pump. When the 
service tank is full and the fuel return is directed to the storage tank, the service tank will provide 
enough fuel for just under 12 hours of operation without the fuel transfer pump. 

Following nonnal operating procedures, the vessel crew sounded the service ta nk on the morning 
of the incident and found that it was full. However, the vessel crew was not aware that the fuel 
return had recently been redirected to the storage tank instead of the service tank. The crew did 
not notice that the level of fuel in the service tank was steadily dropping throughout the day. 
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Had the changes to the fuel return piping been communicated to the crew effectively, the crew 
would have understood that the tank sounding that morning did not guarantee adequate fuel in 
the service ta nk to last the entire day. This may have resulted in the crew paying closer attention 
to the service tank fuel level throughout the day, observation that the fuel level was dropping, 
and investigation and resolution of the problem prior to the incident occurring. 


This causal factor follows multiple paths when mapped to the root cause. 


Root Cause Mapping: 

Changes to Configuration Not Communicated (a) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human (a crew 
member) changed the lineup of the fuel system piping 
configuration of the fuel return but did not adequately 
communicate that change to others in the organization 
who needed to know. 

Problem Category 

Permanent Crew 
(10) 

The crew who did not adequately communicate the 
changes was a permanent SSA vessel crew member. 

Cause Category 

Communications 

(220) 

The problem was caused by a communication failure. 

Cause Type 

Duty / Watch 
Handover Issue 
(241) 

The communication failed to occur during a handover of 
responsibilities from one crew member to another. 

Intermediate Cause 

Communication 
at the Watch 
Handover Issue 
(243) 

The communication failure occurred when a change that 
was made to the configuration of the vessel was not 
adequately communicated to the rest of the crew, or to 
management. 

Solution to 
Intermediate Cause 

Watch processes and communication tools should be modified to ensure that 
all plant configuration changes are documented in a way that is useful to 
vessel crews. For example, include ‘fuel returns to storage tank’ on a wipe 
board, along with information like ‘#1 pumps online/#2 pumps standby’. 

Root Cause Type 

SPAC Issue 
(256) 

Inadequate company policies and administrative controls 
contributed to the occurrence of this incident. 

Root Cause 

No SPAC / Issue 
Not Address 
(257) 

At the root of this causal factor were inadequate company 
policies for documenting changes to vessel configurations 
and procedures for changes of watch. 


Root Cause Mapping: 

Changes to Configuration Not Communicated (b) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human (a crew 
member) changed the lineup of the fuel system piping 
configuration of the fuel return but did not adequately 
communicate that change to others in the organization 
who needed to know. 
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Root Cause Mapping: 

Changes to Configuration Not Communicated (b) 

Category 

Mapping 

Description 

Problem Category 

Permanent Crew 
(10) 

The crew who did not adequately communicate the 
changes was a permanent SSA vessel crew member. 

Cause Category 

Management 
Systems (72) 

The problem resulted from a lack of policies regarding 
authorization and documentation of operational changes. 

Cause Type 

Change Control 
Issue (95) 

Vessel operation was changed without review and/or 
authorization, and without documentation. 

Intermediate Cause 

Change Not 
Identified (96) 

The crew made a change to the plant configuration with 
impacts to vessel operation without communicating it to 
management for review or documenting it in a way that 
would allow management to identify and review it. The 
change would not have been approved by management. 

Solution to 
Intermediate Cause 

Management must have active control of how the vessel plants are operated. 
Develop policies that explain what plant configuration changes are allowed at 
the discretion of the crew, what configuration changes are not allowed, and 
how all such changes are communicated and documented. 

Root Cause Type 

SPAC Issue 
(256) 

Inadequate company policies and administrative controls 
contributed to the occurrence of this incident. 

Root Cause 

No SPAC / Issue 
Not Address 
(257) 

At the root of this causal factor were inadequate company 
policies for understanding and controlling how their crews 
operate their vessels. 


3.4.4 Causal Factor #4: Incomplete PSTP 

The service tank on M/V Martha’s Vineyard is required to have an alarm that annunciates when 
fuel level drops to a dangerously low level. The alarm system for the service tank was not 
properly configured and did not annunciate when fuel was running low. 

In accordance with USCG requirements, testing was undertaken following the vessel’s periodic 
safety test procedures (PSTP). Fuel oil service ta nk level alarms, which are considered by the 
USCG to be vital automation and are required to have been part of this PSTP, were not. If they 
had been, the improperly configured service tank alarm system would have been identified and 
rectified, and the low-level alarm would have notified the crew of the problem prior to the 
blackout. 


Root Cause Mapping: Incomplete PSTP 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human failed to 
include adequate testing of the service tank fuel level alarm 
system in the development of the PSTP. 

Problem Category 

Company 
Employee (12) 

A member of the SSA management was responsible for the 
development of the PSTP (either by other SSA employees 
or a contractor). 
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Root Cause Mapping: Incomplete PSTP 

Category 

Mapping 

Description 

Cause Category 

Management 
Systems (72) 

A failure in management systems resulted in the approval 
of a PSTP that should not have been approved. 

Cause Type 

Document / 
Drawing 

Control Issue 
(100) 

The issue was contained in the PSTP, which is a controlled 
engineering document. 

Intermediate Cause 

Documentation 
Content 
Inaccurate or 
Incomplete 
(101) 

The PSTP did not include a test that is required by relevant 
regulatory authorities. 

Solution to 
Intermediate Cause 

The PSTP should be revised to include all tests required per USCG rules. If 
the SSA does not possess sufficient engineering capability to ensure 
completeness and accuracy of the test document, external engineering 
resources should be used. 

Root Cause Type 

SPACs Issue 
(256) 

Inadequate company policies and administrative controls 
contributed to the occurrence of this incident. 

Root Cause 

SPACs 
Confusing, 
Contradictory, 
or Incomplete 
(259) 

At the root of this causal factor were ineffective company 
policies for overseeing shipyard work, specifically the 
maintenance of critical regulatory documents, such as the 
PSTP. 


3.4.5 Causal Factor #5: Inadequate Vessel Testing 

After a vessel undergoes modifications, especially significant ones like a midlife refit, it should 
not be accepted from the shipyard until adequate testing is performed by the shipyard to prove 
satisfactory operation. 

Testing of vital alarm systems, including the service ta nk low level alann, should have been 
required by the SSA before accepting delivery of the vessel from its midlife refit. If rigorous 
testing had been completed, the improperly configured service ta nk alarm system would have 
been identified and rectified, and the low-level alarm would have notified the crew of the 
problem prior to the blackout. 


Root Cause Mapping: Inadequate Testing 

Category 

Mapping 

Description 

Problem 

Machinery / 
Equipment (2) 

The nature of the problem was an improperly functioning 
tank level alarm system for the fuel service tank. 

Problem Category 

Installation / 
Fabrication 
Problem (9) 

The fuel alarm system was improperly configured during 
modification associated with the shipyard project, such that 
it would not annunciate when fuel was running low. 
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Root Cause Mapping: Inadequate Testing 

Category 

Mapping 

Description 

Cause Category 

Management 
Systems (72) 

Inadequate procurement control resulted in the acceptance of 
the improperly configured alarm system. 

Cause Type 

Purchasing 
Issue (112) 

Acceptance of the improperly configured alarm system was 
a result of a purchasing issue. 

Intermediate Cause 

Inspection on 
Receipt Issue 
(116) 

Inadequate acceptance criteria and approval for the alarm 
system resulted in the acceptance of the improperly 
configured alarm system. 

Solutions to 

SSA personnel 

or contractors acting as the owner's representative during 


Intermediate Causes shipyard or repair periods must be sufficiently involved with all vessel 

modifications to critical systems and equipment to monitor the quality of the 
work. Formalized test and inspection plans should be utilized to ensure all 
inspections and tests are thorough, and to provide a record of all 
inspections/tests. 


Root Cause Type SPACs Issue Inadequate company policies and administrative controls 

(256) contributed to the occurrence of this incident. 


Root Cause 


SPACs 
Confusing, 
Contradictory, 
or Incomplete 
(259) 


At the root of this causal factor were inadequate company 
policies for overseeing shipyard work, specifically 
acceptance approval of procured equipment and completed 
work. 


3.4.6 Solutions to Root Causes - March 17 th Blackout of M/V Martha’s 
Vineyard 


Causal Factor 

1. Fuel Pump Not 
Restarted 


Solutions 

• Develop a comprehensive set of vessel policies/checklists to 
provide crew with direction on how to perform routine operations 
and respond to all likely casualty scenarios associated with each 
vessel. 

• Make these policies/checklists available to all vessel crew in a place 
where they can access them while on watch. 

• Train the vessel crew to utilize the procedures. Educate 
experienced crew, who may not feel the need to utilize such 
prescriptive procedures, on the impact that procedures, used as 
checklists, can have on error avoidance. 
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Causal Factor 


Solutions 


2. Incident 
Evaluation Not 
Performed 


3(a). Changes to 
Configuration Not 
Communicated 


A formal and documented process should be developed that is 
automatically invoked when any vessel experiences a deviation 
from normal operations that impacted, or could have impacted, 
vessel critical systems. The process output should examine and 
document the following: 

• Investigation of the cause of the incident (or near miss) and 
recommendations for follow-up actions or policy/procedural 
changes to prevent reoccurrences (i.e. inspect other similar 
equipment in the fleet). 

• Investigation of the effects of the incident, to ensure all possible 
consequences have been identified and corrected (i.e. identify 
damage which occurred as a result of the incident, which may 
not be evident during recovery from the incident). 

• Recognizing the limitations of situational awareness in the 
aftermath of an incident, develop checklists to ensure vessel is 
restored to full normal operating condition before authorization 
to return to service is issued (e.g. restart fuel transfer pump). 

The SSA should implement engineering management processes 
that: 

• For all aspects of vessel plant configuration that may change 
during the vessel’s service, provide a means of communicating 
current configuration to all watch-standers (such as a wipe 
board or magnetic status board). 

• Train crews to always ‘hand-over’ configuration changes at 

watch turn over. _ 

The SSA should implement engineering management processes 
that: 

• Develop a set of standard operating procedures for each vessel 
that prescribes how vessel equipment is operated, deferring to 
manufacturer’s guidelines and other references where 
appropriate. This document would include details such as 
system line-up, equipment rotation conventions, etc. 

• Make these standard operating procedures available to all vessel 
crew in a place where they can access them while on watch. 

• Train vessel crews on the details of the SOPs and the fact that 
deviations from the policies require explicit permission from 
engineering management. Ensure, as part of the training, that 
the SOPs are understood. 

• Check back with vessel crews to ensure they are operating the 
vessels in accordance with the SOPs. 
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Causal Factor 

Solutions 

4. PSTP 

The SSA should implement engineering management processes that: 

Incomplete 

• Identifies critical record plans and documents like PSTPs 

• Forces individuals within the organization to consider how these 
documents may be impacted by system modifications during 
maintenance, repair, upgrade activities, and ensure that impacted 
documents are updated to reflect changes 

• Requires review of updated documents by individuals other than 
those responsible for the update efforts, who have the technical 
ability to confirm accuracy and completeness of the changes. 

Where the SSA lacks the expertise and/or bandwidth required to 
maintain this process, external resources should be applied. 

5. Inadequate 

For all vital equipment/systems that are installed or modified during a 

Testing 

shipyard or repair period, the SSA should develop a detailed inspection 
and test plan. This test plan should be completed in conjunction with 
vendor and/or shipyard sign-off of the task and regulatory testing of 
the equipment/sy stems. Inspection and test plans may be developed by 
the shipyard or vendors, but such plans should be reviewed and 
approved by the SSA prior to any inspections or testing. Where the 

SSA lacks the technical expertise to develop or approve inspection/test 
plans, external contractors should be utilized. 


3.5 May 5 th Blackout of M/V Martha’s Vineyard 

The capacity of the M/V Martha’s Vineyard fuel service tank (day tank) is 2,974 gallons and the 
capacity of its fuel storage tank is 6,848 gallons, for a total combined capacity of 9,822 gallons. 
When the vessel is in regular service, the vessel typically consumes around 1,000 gallons of fuel 
per day and it is usually fueled three times per week. As a result, the vessel usually has more 
than 6,000 gallons of fuel on hand, and the total amount of fuel in the tanks is only infrequently 
less than 5,500 gallons. In normal operation, a fuel transfer pump constantly transfers fuel from 
the storage ta nk to the service tank. When the service tank is full, excess fuel pumped by the 
transfer pump flows back to the storage tank through fixed overflow piping. 

On the morning of May 3 rd , 2018, one of the Martha’s Vineyard ’s three crews started the plant 
and placed Generator #1 online by itself. At 0500 fuel oil pressure to the generator, final fuel 
pressure (the pressure downstream of the on-engine fuel fdters) was recorded as 95 psi, which is 
below the normal operating range of 100-110 psi. The vessel was recorded to have 
approximately 3,920 gallons of fuel (about 2,974 gallons in the service tank and 946 gallons in 
the storage tank), which is unusually low. The watch changed mid-day to the second of three 
crews. The final fuel pressure to the generator continued to slowly drop throughout the day, 
down to 87 psi at 2000 hours. Despite watch oiler recordings showing final fuel pressure out of 
the normal operating range, no remedial actions were taken. 

The second of three crews started the plant at 0500 on May 4 th and placed Generator #1 online 
by itself. The vessel received 1700 gallons of fuel at 0930. Final fuel pressure to the generator 
was recorded as 87 psi at 1000. The watch changed mid-day, and the third of three crews took 
over the watch. The next recorded reading of final fuel pressure to the generator was taken at 
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1500, indicating that final fuel pressure had dropped off more dramatically, to 51 psi. Despite 
watch oiler recordings showing final pressure out of range, no remedial actions were taken. 

The third of three crews started the plant at 0500 on May 5 th , and again placed Generator #1 
online by itself. No final fuel pressure readings were taken for the generator on May 5 th . At 
1700, the low fuel pressure alarm on Generator #1 sounded. The chief engineer checked the fuel 
filters upstream of the engine and found that they were not causing the drop in fuel pressure. 
Thirty seconds later, Generator #1 was starved of fuel and shut down. The vessel lost all 
electrical power and propulsion, requiring it to drop anchor while the plant was restored on an 
alternate generator. 

It was determined that the fuel filters integral to the John Deere generator were plugged. The 
John Deere filters have finer mesh than the upstream fuel filters, explaining how they could be 
plugged when the upstream ‘Racor’ fuel filters were not. It is possible that the unusually low 
level in the fuel storage ta nk prior to bunkering on May 4 th allowed sediment from the bottom of 
the storage tank to pass to the service tank, contributing to the fouling of the fuel filters. 

The low fuel pressure alarm for the vessel’s alarm management system (AMS) was set to 25 psi, 
which is lower than the operating pressure for the vessel’s generators, explaining why the chief 
engineer had just thirty seconds to try to investigate and remediate the cause of the alarm before 
the engine was starved of fuel and the vessel lost power. 

Root cause analysis of this event resulted in the causal factor chart illustrated in Appendix A, and 
identification of the following causal factors: 

Causal Factor #1: Watch processes do not force engineer on watch to ensure readings are 
within normal operating ranges. 

Causal Factor #2: Management of third-party vendor in shipyard lacked sufficient controls to 
ensure alann points were properly set. 

Causal Factor #3: Incorrect specification of critical design parameters, which resulted in an 
ineffective PSTP. 

Determinations of root causes for these causal factors are described below. 

3.5.1 Causal Factor #1: Insufficient Watch Processes 

On May 3 rd at 0500, 60 hours prior to the incident, fuel pressure downstream of the fuel filters 
(final fuel pressure) fell below the normal operating range of 100-110 psi. Fuel pressure 
continued to drop steadily, with the last reading prior to the incident recorded as 50 psi on May 
4 th at 1900. On the day of the incident, May 5 th , no final fuel pressure recordings were made 
until after the incident. 

All three of the permanent crews assigned to the vessel stood watch during the 60-hour period 
where the fuel pressure was below normal, but none recognized the difference between normal 
fuel oil pressure and critically low fuel oil pressure. This suggests that the existing policies and 
procedures governing how watch standers perform their duties are failing to: 

• Ensure that watch oilers record all critical plant parameters on a regular basis. 

• Ensure that watch chief engineers review all plant readings, and consider whether or not 
they are correct and indicative of nonnal operation. 

• Provide watch standers with the tools and/or training they need to be able to differentiate 
between a ‘normal’ process value vs. a process value that is ‘out of range.’ 
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Root Cause Mapping: 

Watch Processes 


Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that humans (SSA 
engineering management) have not instituted watch 
policies that ensure the safe operation of the SSA 
vessels. 

Problem Category 

Company 

Employee (12) 

SSA engineering management, who are company 
employees, are responsible for the performance of watch 
standers. 

Cause Category 

Procedures (120) 

Watch processes in place onboard the SSA vessels do 
not force watch standers to observe, record, and evaluate 
plant process variables. 

Cause Type 

Wrong / 

Incomplete (135) 

Intermediate Cause 

Incomplete / 
Situation Not 
Covered (141) 


Solution to 
Intermediate Cause 

Watch stander logging requirements should be changed to highlight critical 
plant parameters, and define their normal ranges, such that process deviations 
critical to operations are more readily identified. 

Root Cause Type 

SPAC Issue (256) 

Inadequate company policies, procedures, and checklists 
for how to ensure continuous, normal operation of the 
vessel contributed to the occurrence of this incident. 

Root Cause 

No SPAC / Issue 

Not Addressed 
(257) 

At the root of this causal factor was a lack of standard 
vessel operating procedures to ensure continuous, normal 
operation of the vessel. 


3.5.2 Causal Factor #2: Insufficient Shipyard Management 

Generator fuel oil pressure alarms, which are considered by the USCG to be vital automation and 
are required for vessels such as the M/V Martha’s Vineyard, were incorrectly configured by the 
automation contractor who modified the vessel alann system as part of the vessel's midlife 
upgrade project. The improper configuration prevented the alann system from annunciating an 
audible and visual alarm before the fuel engine shut down from lack of sufficient fuel supply. 


Root Cause Mapping: Shipyard Management 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human (SSA 
engineering management), failed to ensure the quality of 
work performed by a contractor during a shipyard repair 
period. 

Problem Category 

Company 
Employee (12) 

SSA engineering management, who are company 
employees, are responsible for quality of work 
performed by vendors and contractors during shipyard 
periods. 
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Root Cause Mapping: Shipyard Management 


Category Mapping Description 


Cause Category 

Management 
Systems (72) 

The SSA’s technical specification for the M/V Martha’s 
Vineyard mid-life refit project instructed the shipyard to 
hire a specific automation contractor to modify the 
existing vessel alarm system, but provides no further 
technical direction on functional requirements. 
Management of that vendor during the shipyard period 
also failed to convey functional requirements. The SSA 
also failed to require or conduct testing that would have 
proven critical functionalities. 

Cause Type 

Purchasing Issue 
(112) 

Intermediate Cause 

Inspection on 
Receipt Issue 
(116) 

Solution to 
Intermediate Cause 

SSA personnel acting as an owner's representative during shipyard or repair 
periods must be sufficiently involved with all vessel modifications to critical 
systems and equipment to monitor quality of work. When critical systems are 
modified, such as the installation of new generators, technical details like 
alarm setpoints should be reviewed and documented in technical specifications 
or commissioning check lists. The SSA should require shipyards performing 
work on their vessels to submit detailed specifications to the SSA for all work 
(including work done by subcontractors and equipment vendors), which the 

SSA should review in detail. 


The SSA should also require shipyards to submit detailed test procedures for 
proving functionality of all new or modified equipment, to be reviewed in 
detail and approved by the SSA, and then carried out with a representative of 
the SSA witnessing the tests. 

Root Cause Type 

SPACs Issue (256) 

Inadequate company policies, procedures, and checklists 
for how to ensure procured equipment have the 
appropriate specifications contributed to the occurrence 
of this incident. 

Root Cause 

SPACs Confusing, 
Contradictory, or 
Incomplete (259) 

Company policies for the management of contractors and 
vendors are inadequate. Technical details should be 
reviewed in detail to ensure critical elements are 
designed correctly and appropriately. 

3.5.3 Causal Factor #3: Incomplete PSTP 

Alarms associated with low fuel oil pressure to the ship service generators are considered to be 
‘vital automation’ by the USCG, and therefore are required to be included on the vessel’s 
periodic safety test procedure (PSTP), and tested annually to confirm proper function. The set 
points for these alarms on the M/V Martha’s Vineyard were incorrectly specified on the vessel’s 
PSTP, allowing the annual functional tests to be performed without identifying the fact that the 
alarms were not providing any protection from a low fuel pressure shutdown. 

Root Cause Mapping: Ineffective PSTP 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human (SSA 
engineering management) incorrectly specified the set 
point for the vessel’s generator low fuel pressure alarm 
on the vessel’s Periodic Safety Testing Procedure 
(PSTP) 
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Root Cause Mapping: Ineffective PSTP 

Category 

Mapping 

Description 

Problem Category 

Company Employee 
(12) 

SSA engineering management, who are company 
employees, are responsible for maintaining the 
accuracy of critical documents such as the PSTP 

Cause Category 

Procedures(120) 

The incorrect specification of the low fuel oil pressure 
setpoint on the PSTP prevented the SSA from 
discovering the fact that they lacked an effective alarm 
as protection against low fuel pressure situations, 
despite the fact that the test dedicated to the 
identification of such situations was performed as 
directed on the test procedure. 

Cause Type 

Wrong/Incomplete 

(135) 

Intermediate Cause 

Facts 

Wrong/Requirements 

Incorrect 

Solution to 
Intermediate Cause 

SSA engineering management should ensure the accuracy of critical 
documents like vessel periodic safety test procedures by establishing quality 
processes specific to those documents. Quality processes should designate 
‘owners’ responsible for such critical documents and provide for independent 
technical review when these documents are created or modified. Where the 

SSA does not possess sufficient technical resources to perform this review, 
external contractors shall be utilized. 

Root Cause Type 

SPAC Issue (256) 

Inadequate company policies, procedures, and 
checklists to ensure the accuracy of critical documents 
such as the vessel’s PSTP contributed to the 
occurrence of this incident. 

Root Cause 

SPACs Confusing, 
Contradictory, or 
Incomplete (259) 

SSA engineering management lacks a functional 
process to ensure that critical quality backstops, like 
the annual testing of vessel automation that is required 


by the USCG, is performed successfully. 
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code had been tested but not to the point of failure, resulting in the weakness not being 
identified. Although the system employs multiple firewalls and other backup systems to protect 
against high traffic, this part icular code acted as a bridge between the website and the internal 
reservation system, which utilized only one connection to the multiple webservers. 

The root cause analysis of this event resulted in identification of the following causal factors: 

Causal Factor #1: Adequate load testing was not performed. 

Causal Factor #2: Secondary and mirrored cloud-based website not utilized. 

Determinations of root causes for these causal factors are described below. 

3.6.1 Causal Factor #1: Inadequate Load Testing 

Although the system had not failed in almost five years since the suspect code had been in place, 
the system had also not been adequately load tested. Load testing to the point of failure by a 
reputable firm which aids in identifying any issues as well as providing solutions should be 
conducted on a routine basis as well as on an ad hoc basis prior to significant events that may 
stress the system. 


This causal factor follows multiple paths when mapped to the root cause(s). 


Root Cause Mapping: Adequate Load Testing Not Performed (a) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) relied on 
inadequate load testing of the system. 

Problem 

Category 

Company Employee 
(12) 

The individuals responsible for determining testing 
requirements were company employees. 

Cause 

Category 

Procedures(120) 

A procedure should identify the testing requirements for the 
system. 

Cause Type 

Wrong / Incomplete 
(135) 

The unwritten procedure followed was inadequate / 
incorrect. 

Intermediate 

Cause 

Incomplete / 

Situation Not 
Covered (141) 

An adequate procedure for load testing the system does not 
exist. 

Solution to 

Intermediate 

Cause 

Adequate load testing should be performed on the system prior to the next major 
event. 

Root Cause 
Type 

SPACS Issue (256) 

No procedure exists to ensure that adequate load testing is 
performed on the reservation system on a predetermined 

Root Cause 

No SPACs / Issue 
not Addressed (257) 

and established severity of tests. 


Root Cause Mapping: Adequate Load Testing Not Performed (b) 

Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) relied on 
inadequate load testing of the system. 

Problem 

Category 

Company Employee 
(12) 

The individuals responsible for determining testing 
requirements were company employees. 
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Root Cause Mapping: Adequate Load Testing Not Performed (b) 

Category 

Mapping 

Description 

Cause 

Category 

Maintenance Program 
Implementation (40) 

The maintenance program was not fully implemented. 

Cause Type 

Servicing and Routine 
Inspection Issue (64) 

The routine inspections (testing) of the system were not 
adequate. 

Intermediate 

Cause 

S cheduling/Frequency 
Issue (65), Scope 

Issue (64) 

The scheduling of load testing as well as the scope of 
testing was inadequate. 

Solution to 

Intermediate 

Cause 

Determine an adequate frequency of load testing, identify major events, and 
determine an adequate scope of testing. 

Root Cause 
Type 

SPACS issue (256) 

No procedure exists to implement the proper levels and 
frequency of load testing. 

Root Cause 

No SPACs / Issue not 
Addressed (257) 



3.6.2 Causal Factor #2: Lack of System Redundancy 

At the time of the incident the website was hosted internally by the SSA. This presented a single 
point of failure for a mission critical system as a secondary and mirrored cloud-based website 
was not being utilized for redundancy. 


Root Cause Mapping: Secondary and Mirrored Cloud-Based Website Not Utilized 

Category 

Mapping 

Description 

Problem 

Machinery / 
Equipment (2) 

The nature of the problem was that the system / 
equipment was insufficient. 

Problem Category 

Design Problem 
(6) " 

The system design was insufficient. 

Cause Category 

Design Input / 
Output (20) 

Design input did not ensure adequate redundancy in the 
system. 

Cause Type 

Design Input Issue 
(21) 


Intermediate Cause 

Design Input 
Incorrect (24) 

Design input did not ensure adequate redundancy in the 
system. 

Solution to 
Intermediate Cause 

The system design should be reviewed in order to determine the feasibility of 
attaining redundancy in the system. 

Root Cause Type 

SPACS Issue 
(256) 

The design process is not administered to ensure mission 
critical systems meet established standards, such as 

Root Cause 

Not Strict Enough 
(258) 

redundancy. Quality control is not in place to ensure 
established standards are met. 
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3.6.3 Solutions to Root Causes - January 11 th Website Slowdown 


Causal Factor 

Solutions 

1. Adequate Load 
Testing Not 
Performed 

Develop a procedure to ensure that adequate load testing is performed 
on the reservation system. Confirm a schedule and severity of tests. 

2. Secondary and 
Mirrored Cloud- 
Based System 

The design process should be administered to ensure mission critical 
systems meet established standards, such as redundancy. Quality 
control should be introduced to ensure established standards are met. 


3.7 IT - Trip Alert Emails Blocked 

On March 9 th , after several periods of ferry service disruptions, it was discovered that a large 
volume of trip alert emails had been blocked by email service providers. Some trip alerts were 
blocked entirely while others were delayed. 

The trip alert system was utilizing an internal email server and the SSA domain for sending the 
trip alert emails. These were being flagged as spam by the Internet Service Providers (ISPs). 

The root cause analysis of this event resulted in identification of the following causal factors: 

Causal Factor #1: Inadequate system design. 

Causal Factor #2: Insufficient email list analysis. 

Determinations of root causes for these causal factors are described below. 

3.7.1 Causal Factor #1: Inadequate System Design 

Although the email system had not experienced serious issues up to this point, it had not been 
tested to this extent. Considering the critical nature of the communications system, the design 
process should have established a much higher minimum standard. The limitations of utilizing 
an internal email server and the SSA domain should have been identified as insufficient. 


Root Cause Mapping: 

System Not Adequately Designed 

Category 

Mapping 

Description 

Problem 

Machinery / 
Equipment (2) 

The nature of the problem was that the system was 
insufficient. 

Problem Category 

Design Problem 
(6) 

The system design was insufficient. 

Cause Category 

Design Input / 
Output (20) 

Design input did not ensure adequate functionality of the 
system. 

Cause Type 

Design Input Issue 
(21) 


Intermediate Cause 

Design Input 
Incorrect (24) 

Design input did not ensure adequate functionality of the 
system. 

Solution to 
Intermediate Cause 

The system design should be reviewed in order to identify a more reliable 
email distribution server and domain. 

Root Cause Type 

SPACS Issue 
(256) 

The design process is not administered to ensure mission 
critical systems meet established standards, such as 
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Root Cause Mapping: System Not Adequately Designed 


Category Mapping Description 


Root Cause 


Not Strict Enough 
(258) 


reliability. Quality control is not in place to ensure 
established standards are met. 


3.7.2 Causal Factor #2: Insufficient Email List Analysis 

The SSA’s internal email list was not analyzed by an outside vendor for integrity to ensure all 
emails are legitimate and accurate. Doing so would have avoided the sending of emails to false 
addresses, thus triggering spam alerts by the ISP. 


Root Cause Mapping: Outside Vendor Not Utilized to Analyze Internal Email List 


Category 

Mapping 

Description 

Problem 

Human (4) 

The nature of the problem was that a human(s) relied on 
inadequate testing of the system. 

Problem 

Category 

Company Employee 
(12) 

The individuals responsible for determining testing 
requirements were company employees. 

Cause 

Category 

Procedures (120) 

A procedure should identify the testing requirements for the 
system. 

Cause Type 

Not used (121) 

A procedure for establishing the testing requirements was 
not used. 

Intermediate 

Cause 

No Procedure for 
Task / Operation 
(122) 

A procedure for establishing the testing requirements did 
not exist. 

Solution to 

Intermediate 

Cause 

Develop a procedure for establishing the testing requirements of the trip alert email 
system. 

Root Cause 
Type 

SPACS Issue (256) 

No procedure exists to ensure that adequate testing is 
performed on the trip alert email system. 

Root Cause 

No SPACs / Issue 
not Addressed (257) 




3.8 IT - Loss of Connectivity due to Storm 

In March of 2018, a Nor’Easter storm caused the SSA to lose all connectivity to its website. 
Power to the website server was maintained during this period due to backup generators, but the 
loss of internet from SSA’s sole ISP caused the website and other essential services to be 
unavailable to the public. 

The root cause analysis of this event resulted in identification of the following causal factors: 
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Causal Factor #1: System design allowed for a single-point-of-failure. 

Determinations of root causes for these causal factors are described below. 

3.8.1 Causal Factor #1: Lack of System Redundancy 

Due to the location of the SSA administration building where the website server is located, it is 
not possible to have redundant ISPs using varied routing to ensure connectivity. When hosting 
web-based systems internally, such ISP redundancy is generally considered a standard design 
requirement. Another acceptable alternative is to employ a secondary cloud-based system that is 
not subject to natural disasters or regional power outages. As it was designed, neither method of 
redundancy was employed, exposing the system to single point failure. 


Root Cause Mapping: System Design Allowed for Single-Point-Of-Failure 

Category 

Mapping 

Description 

Problem 

Machinery / 
Equipment (2) 

The nature of the problem was that the system was not 
adequately protected from acts of nature. 

Problem Category 

Design Problem 
(6) " 

The system design was insufficient. 

Cause Category 

Design Input / 
Output (20) 

Design input did not ensure adequate redundancy of the 
system. 

Cause Type 

Design Input Issue 
(21) 

Design input did not ensure adequate redundancy of the 
system. 

Intermediate Cause 

Design Input 
Incorrect (24) 


Solution to 
Intermediate Cause 

The system design should be reviewed in order to determine a more reliable 
internet source in event of natural disasters or other interruptions of service. 

Root Cause Type 

SPACS Issue 
(256) 

The design process is not administered to ensure mission 
critical systems meet established standards, such as 

Root Cause 

Not Strict Enough 
(258) 

redundancy. Quality control is not in place to ensure 
established standards are met. 

3.8.2 Solutions to Root Causes 

- Connectivity Issues Due to Storm 

Causal Factor 

Solutions 


1. System Design 
Allowed for SPoF 

The design process should be administered to ensure mission critical 
systems meet established standards, such as redundancy. Quality 
control should be introduced to ensure established standards are met. 
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Section 4 General Observations 

4.1 Management Structure 

4.1.1 Mission Statement 

It is important for any organization to have clearly established goals and a means by which to 
measure its progress toward achieving them. Advertising a common mission statement at all 
levels of the organization ensures the entire team is working toward the same end. Mission 
success is achieved by establishing organizational key performance indicators (KPIs), 
periodically measuring them, and making adjustments to address any unsatisfactory results. 

Interviews with employees from multiple departments and at all levels of the SSA revealed that 
there is not a consistent mission statement that provides a common direction to the organization 
that is well advertised and highly visible throughout the organization and to the public. 

Section I of SSA’s Enabling Act contains the following statement (Reference 7): 

“In order to provide adequate transportation ofpersons and necessaries of life 
for the islands of Nantucket and Martha's Vineyard, the Authority is hereby 
authorized and empowered to purchase, construct, maintain and operate 
necessary vessels, docks, wharves, other vessels, equipment, furniture and 
supplies and to issue its revenue bonds payable solely from revenues, or funds 
as hereinafter authorized in section nine of this act. ” 

This statement is not publicly advertised throughout the organization and does not provide an 
inspiring direction by which employees at all levels can rally. 

On the SSA’s website, the following statement is made on the History & Organization page: 

“The Steamship Authority's statutory mission is to serve as the ''Lifeline to the 
Islands ''for everyone from year-round residents, who depend on the ferries for 
all commerce and transportation to and from the mainland, to a significant 
seasonal population, to the tourists who visit for a day, a week or longer. ” 

While this identifies a ‘statutory mission’, it doesn’t actually contain a complete mission 
statement identifying how it is accomplished, what value is provided, or what the organization 
strives for. 

The website is the only place this statement was observed; however, even there it was not easily 
identifiable and it is not advertised to employees. 

There is also a lack of established performance objectives for the organization as a whole. Some 
senior executives who are aware of the statement contained in the Enabling Act have a common 
objective, but there does not appear to be a clear method by which to measure progress, success, 
or failure of the organization to succeed in its mission. 

4.1.1.1 Issues 

Organizational issues associated with the lack of a mission statement are wide ranging. Many 
companies exist without established mission statements, however the benefits realized by those 
who develop, embrace, and frequently reference one are clear and impactful. The benefits a 
mission statement provides include: 

• A common direction. 

• Focus of the company’s future (commonly referred to as ‘Vision’). 
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• Establishment of priorities and aid for decision-making at all levels. 

• Alignment of team, from new-hires to long-tenured executives. 

• Support for necessary change. 

• Guidance for strategy. 

• A basis for measuring perfonnance. 

Multiple competing interests are creating confusion and misdirection amongst SSA employees. 
For example, the root cause analysis performed on the delay in return from the repair period of 
the M/V Island Home (Section 3.3) underscores how decision-making was hampered by a lack 
of clear direction. In other cases, covered in more detail in other general observations included 
in this study, there were indications of a lack of common direction, resistance to change, and a 
lack of strategic planning. 

4.1.1.2 Industry Standards/Best Practices 

A well-crafted, advertised, and frequently revisited mission statement that provides a common 
goal, combined with measurable performance objectives, provides numerous benefits to any 
organization. Public and private ferry systems, including near-monopolies similar to the SSA 
that are not influenced by the same competitive environment as most, have established mission 
statements and employ perfonnance objectives. Examples include Washington State Ferries and 
the Delaware River and Bridge Authority (Cape May-Lewes Ferry). Typically, these mission 
statements are simple and to the point, communicating a common direction to the employees, 
leadership, and the public. 

Performance objectives are also common in the industry as a way to measure progress toward the 
mission, identify shortcomings, and make necessary adjustments. These objectives and the 
organization’s progress are commonly completely transparent and communicated to employees 
and the public. See Section 4.3.7 for further information on this topic. 

4.1.1.3 Specific Solutions 

SSA management, in cooperation with the Board and Port Council, should craft a mission 
statement which identifies the organization’s purpose and direction. A strong mission statement 
is clear and concise, and answers four basic questions: 

• What do we do? 

• How do we do it? 

• Whom do we do it for? 

• What value are we providing? 

It is also important to emphasize specific elements of the company culture that should be 
reinforced. For example, a common theme in the maritime industry is safety. If safe operations 
is a paramount concern, it should be reflected in the mission statement. 

After the mission statement is crafted, performance objectives should be developed so that the 
organization’s alignment with the mission can be continually monitored. Perfonnance objectives 
must be measurable and have a tenn assigned to them, such as annually (see Section 4.1.2). 

The mission statement and performance objectives should be advertised to ah levels of the 
organization frequently. It is critical to give consistent and high-profile reinforcement in order to 
attain buy-in from the employees. This is accomplished by making the statement and objectives 
highly visible and, most importantly, following them in actions and decision-making. The more 
affirmation and exposure they receive, the more buy-in they will generate and the more effective 
they will be in establishing a cohesive team working toward a common direction. 
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4.1.2 Strategic Planning 

SSA is excellent at reacting to situations or “putting out fires.” However, the evidence and 
consensus opinion is also that the SSA suffers from an absence of strategic planning. The result 
is an organization that lacks meaningful goals, has employees working against each other, and 
does not adapt to the evolving needs of its customers. 

“We’re spread so thin, we’re stuck at reactionary versus looking forward. ” - 
SSA Executive 

“We are trying to get out of the weeds before we look down the road. ” -SSA 
Executive 

Strategic planning provides a framework for making long-term decisions, aligns goals across an 
organization, and helps to ensure the long-term availability of the resources critical to 
organizational success. Each of these have been problem areas for the SSA. 

The only observed planning process with a time horizon beyond one year was capital budget 
planning, with a two- or three-year horizon. This exercise omits key factors from the decision¬ 
making process due to both its limited breadth and time horizon. For example, when deciding 
whether or not to add a run to the schedule, three critical dimensions need to be weighed: 
quantity of service, cost of service, and quality of service. A capital budget plan will only 
provide limited guidance on goals for cost of service. A strategic plan will provide guidance on 
the desirable tradeoffs between quantity, quality, and cost, as well as any other metrics that are 
important to the strategy of the organization. 

The SSA management generally understands that more planning would provide a net benefit to 
the organization. Despite this understanding, there are two primary reasons why strategic 
planning has not been prioritized. First, the daily schedules of management appear to be 
generally overburdened (see Section 4.1.4 Staffing). Without more management bandwidth, it 
will be hard for management to transition resources from reacting to planning. 

Secondly, management is disincentivized to perfonn long-term strategic planning. In any 
successful organization, management is held accountable for operational performance. At the 
SSA, management is not adequately held accountable, because there are no objective 
performance metrics against which to be measured. One of the benefits of a strategic plan is that 
it provides a basis for creating and maintaining performance metrics. The lack of performance 
metrics provides management with job security. Despite this, we observed that the SSA 
managers generally appreciated the need for more planning and wished they did a better job at it, 
as it would improve their ability to manage. Additionally, we observed that management is 
devoted to organizational success for many admirable reasons, such as pride, compassion, 
morality, and ethics. However, the incentives for management to not perform strategic planning 
should not be ignored as a barrier to implementation. 

4.1.2.1 Issues 

Without a clear strategic plan, making informed decisions that will have long-term effects on the 
organization is difficult or impossible. For example, consider the optimization of ferry 
schedules. As illustrated in Figure 2, a basic tradeoff has to be made between affordability, 
reliability, and quantity. Each of these performance metrics affects the others. To increase 
affordability requires the elimination of unprofitable runs (reduce quantity) or to divest of 
backup vessels (reduce reliability). To increase reliability requires investing in new vessels 
(reduce affordability) or eliminating runs to increase backup capacity (reduce quantity). To 
increase the quantity of service requires increasing unprofitable runs (reduce affordability) or 
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divesting of backup vessels (reduce reliability). A strategic plan will define the correct balance 
of affordability, reliability, and quantity. 



Figure 2 Cost, reliability, and quantity tradeoffs 

A strategic plan allows for meaningful key performance indicators (KPIs) to be developed and 
tracked. In the example above, there are three KPIs: affordability, reliability, and quantity of 
service. These KPIs will be reviewed periodically, and if the appropriate balance is not struck by 
meeting perfonnance goals for each metric, remedial actions can be taken to align the actual 
service with the targets set by the strategic plan. 

A lack of a clear strategic plan makes it difficult to align the goals of employees across the 
organization. Without a clear strategy, front-line employees cannot effectively communicate to 
customers why the organization is operating the way it is. It also hinders employee-management 
communication. Employee feedback is an extremely valuable tool for an organization to utilize, 
but will tend to be incohesive and difficult for management to respond to if there is not a unified 
strategic vision for the company on which to rely. This may contribute to the feeling by 
employees that their feedback is currently unappreciated and underutilized (see Section 4.1.9 
Tenure). 


A strategic plan helps to ensure the necessary resources are available to the organization over the 
long run. For example, ferries are assets with service lives of well over thirty years. Without an 
understanding of how the organization intends to utilize these fundamental assets to address the 
evolving needs of its customers and work force in the future, the optimality of the vessel design 
over its service life is impossible to measure. 

Strategic planning also plays a crucial role for capital planning of major capital projects such as 
terminal modifications and ferry acquisitions, by identifying well in advance when assets should 
be acquired and retired so that fundraising efforts can be conducted. For example, the SSA 
appears to be missing out on federal grant funding due to its lack of long-term planning. 


“We haven’t gone after more federal money because it wasn ’t needed based on 
our old formula” -SSA Executive 

Without a clear strategic vision, an organization will be stuck in a reactive mode, only changing 
when latent issues manifest themselves as incidents (such as the events of the spring of 2018), or 
exogenous events force a change (such as increasing populations of the islands). Decisions are 
uninformed, avoidable incidents occur, employees work towards different goals, and 
opportunities are missed. 


4.1.2.2 Industry Standards/Best Practices 

Strategic planning is a standard practice of successful ferry operators across North America. 
Typically, strategic planning is communicated via a strategic plan report that is periodically 
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updated, although there are different formats in which to convey a strategic plan and each 
organization should select the fonnat which best meets their unique needs. 

Strategic plans also provide a framework for more specific planning exercises, including capital 
planning and maintenance planning. 

There are many publicly-available examples of ferry services publishing and implementing 
effective strategic plans. The following examples are provided for inspiration and reference: 

• Washington State Ferries, the largest ferry operator in the United States, develops and 
publishes a comprehensive long range plan every decade, intended to guide internal 
planning, inform investment and fundraising decisions, and facilitate coordination with 
other agencies that are stakeholders of the service they provide. 

• “The WSF 2040 Long Range Plan (the Plan) provides a vision intended to 
guide the future service and capital investment decisions for this critical 
part of the State highway system. ” (Reference 13) 

• San Francisco Bay Area Water Emergency Transportation Authority (WETA) 

operates 12 passenger-only ferries between 7 terminals in the San Francisco Bay Area 
and is in the midst of surging ridership due to roadway congestion. Their 20-year plan, 
last published in 2016, “sets forth a vision, mission and priorities for the next 20 years of 
SF Bay Ferry Service. ” (Reference 14). 

• BC Ferries, one of the largest ferry operators in the world, publishes strategic goals and 
its KPI results in its annual report (Reference 4): 


Strategic Goals 

Key Performance Indicators 

• 

Ensure safe, reliable, and efficient operations 

• 

Employee Safety 

• 

Deliver a customer-focused travel experience 

• 

Passenger Safety 

• 

Foster a productive, motivated, & engaged work 
force 

• 

Vessel Reliability 

• 

Be a leader in environmental and social governance 

• 

Customer Satisfaction 

• 

Grow and profitably diversify our revenue base 

• 

Net Earnings 

• 

Drive prudent investment in our capital assets 




• Casco Bay Lines operates five ferries on eight routes in Casco Bay, Maine, and recently 
began publishing their KPI results and long-range capital plans. Their KPIs are reported 
in six categories: financial, productivity, ridership & vehicles, marketing, customer 
service, and safety. 

• Pierce County Ferry operates two ferries and periodically commissions a Waterborne 
Transportation Study in order “to identify key issues facing the Pierce County ferry 
system and make recommendations to ensure the long-term financial sustainability of the 
service. ’’ (Reference 1). The most recent study included an assessment of the current and 
future states of the demand on the ferry service, assessment of future challenges and 
opportunities, and recommendations for short- and long-term success. 

4.1.2.3 Specific Solutions 

The following solutions would address the problems that were observed as a result of inadequate 
strategic planning: 
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• Develop a strategic plan. Doing this properly will require significant resources, 
including approximately four of the SSA executives, one of whom is directly responsible 
for executing its development, as well as the Board of Directors and the Port Council. 

This task is also frequently outsourced to management consultants experienced in the 
process, but at least half of the development effort must belong to the SSA personnel to 
be effective. 

• Implement management performance metrics based on the goals laid out in the 
strategic plan. Managers should be held accountable to the organization for meeting 
performance metrics that are approved by the Board of Directors on an annual basis. One 
or more of the SSA executives should also be held accountable for the periodic updating 
of the strategic plan. These performance criteria will change the incentive structure such 
that development of the strategic plan will be prioritized and management’s actions will 
be aligned with the strategic goals of the organization. 

4.1.3 Operations Structure 

Several factors of SSA’s organizational structure were observed to contribute to varying levels of 
disfunction within the operations group and the organization as a whole. 

The vessel operations and vessel engineering functions are in separate departments. As 
illustrated by the 6/26/18 Organization Chart (Figure 3), while vessel operations is in the Vessel 
Operations Department and reports to the Operations Manager (through the Port Captain), vessel 
engineering is in the Engineering and Maintenance Department and reports to the Director of 
Engineering and Maintenance (through the Port Engineer). Discussions with crew and other 
personnel made it clear that this creates ongoing confusion and friction at times. Most vessel 
engineering crew understood the chain of command on board and the authority of the captain, 
but it was clear that having multiple direct lines of reporting off the vessel creates confusion. 
There should only be one direct line of reporting off the vessel, from the Captain to the Port 
Captain. Indirect reporting between the vessel crew and support functions is necessary and of 
great value to the crew. But the current structure identifies the reporting between vessel 
engineers and the Port Engineer as a direct line. This was evidenced by several of the root cause 
analyses performed as a part of this study. 



Figure 3 Current organizational structure 
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The same organizational chart, supported by conversations with crew and other documents 
reviewed, indicates that the Engineering and Maintenance Department functions as a Tine’ 
department 1 within the chain of command, rather than a ‘staff department 2 . This causes 
confusion about authority and decision-making within vessel operations. 

Vessel Operations is a core function of the SSA, but is under-represented at the executive and 
director levels of the organization. The highest representation of the Vessel Operations 
Department in the management structure is the Port Captain (currently an unfilled position, 
thereby deferring to the Assistant Port Captain), who reports to and is heavily relied upon by the 
Operations Manager. The Engineering and Maintenance Department, by contrast, is represented 
at the director level, which amplifies the confusion about authority and frictions between staff 
members discussed above. 

4.1.3.1 Issues 

Clear communication between Vessel Operations and Engineering and Maintenance is critical to 
the SSA mission, as those two departments must be able to efficiently collaborate on functions 
critical to the SSA, including vessel maintenance, training sequences, and scheduling. When the 
vessel engineers’ reporting structure is either confusing or short-circuited, this communication 
becomes strained and complex, hindering any collaboration required. 

As a line function, the Engineering and Maintenance Department has the authority to make 
critical decisions that directly affect the vessels and their operation. This complicates 
communications and creates unnecessary friction with the Vessel Operations Department, which 
should have the ultimate authority over how the vessels are operated. The Engineering and 
Maintenance Department should advise the Vessel Operations Department as a staff function. 

Vessel Operations is a primary function of the SSA. The absence of maritime operations 
expertise at a high level of authority within the organization marginalizes the functionality of the 
Vessel Operations Department. 

As currently structured, the Operations Manager must balance their time between managing 
reservations, tenninal and parking lot operations, security, and vessel operations. This situation, 
combined with the authority given to engineering, further reduces the ability of Vessel 
Operations personnel to exercise their authority and advance their priority issues. 

4.1.3.2 Industry Standards/Best Practices 

Many maritime operations struggle with organizational issues due to the complexities of 
communication between vessels, shoreside management, and various operational support 
functions. All maritime operations are unique; however, the following best practices have 
proven to be consistently effective in this rapidly evolving industry: 

1. A clearly defined chain of command on the vessel. 

2. Acknowledgement and support of the vessel master’s authority and responsibility. 

3. Clear and concise communications protocols. 

4. Minimized off-vessel reporting outside the chain of command (short circuits). 

5. Clearly defined line and staff roles. 


1 A line department or function is one which directly advances an organization in its core work. 

2 A staff department or function is one which supports the organization with specialized advisory and support 
services. 
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4.1.3.3 Specific Solutions 

The following solutions are intended to improve the lines of communication between Vessel 
Operations, Engineering and Maintenance, and leadership of the SSA: 

• Reinforce the chain of command on board and eliminate any additional direct reporting 
off the vessels. All direct reporting should follow the chain of command through the 
vessel captain to ensure those with the responsibility and authority are fully informed. 
While some indirect reporting will remain necessary, it should be minimized and should 
never circumvent direct reporting. 

• Designate the Engineering and Maintenance Department as a staff function, providing 
advisory service and support to the various departments requiring it. This is similar to IT, 
HR, and other staff functions. This is not intended to diminish the highly important role 
of the department and the critical services it provides but rather to acknowledge that the 
line authority remains with Vessel Operations and does not compete with additional 
authority levels in engineering. 

• Increase maritime operations experience at the director or executive level by adding a 
position. This should be a position in the direct chain of command between the Port 
Captain and leadership as well as between the Director of Engineering and leadership. 
This position would reduce the immediate burden on leadership while ensuring the 
priorities of vessel operations are properly represented at the highest levels of authority. 
See Section 5.3. 

4.1.4 Staffing 

As a ferry operator that covers 100% of its operating expenses through fare box revenue, the 
SSA’s ticket prices are directly related to its operating costs. The SSA management therefore 
takes pride in minimizing costs in order to minimize fares. One way that the SSA keeps costs 
down is to minimize staffing. This lean mentality is admirable, but the organizational 
breakdowns in the spring of 2018 illuminated that some aspects of the effort leaves the 
organization vulnerable. Management staff levels have not kept pace with growth, leaving the 
organization understaffed. 

This section describes how the SSA management in general may be understaffed. Also see 
Section 4.2.2 Engineering Resources, for observations about how the engineering department in 
particular is suffering from deficient human resources. 

Being an organization focused on cost-cutting has long been part of the SSA culture. However, 
as demand on the organization has grown over the past decade, the capacity of management has 
not kept up. This is illustrated by Figure 4 and Figure 5 below, in which it is shown that over the 
last ten years the number of administrators has decreased by 16% relative to operating revenues 
(normalized to 2017 dollars using the Consumer Price Index), and by 7% relative to the number 
of passenger trips and vehicle trips made. 
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Figure 4 Staffing versus operating revenue as a percentage of 2010 levels 
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Figure 5 Staffing versus passenger and vehicle demand as a percentage of 2008 levels 

In addition to increased traffic, customer expectations have increased. For example, an SSA 
executive noted that over the years, runs have been added to the ferry schedule, some of which 
are unprofitable. Adding runs increases the demand on management and raises fares if the runs 
are unprofitable. The only way to manage this increased level of service without increasing fares 
is to increase the workload on the existing members of the organization. 

Nearly every SSA administrator that was interviewed expressed that they were performing a 
significant number of tasks that they believed they should not be performing, due to one or more 
of the following reasons: 

• A task has to get done, but nobody else is responsible for or willing to do it. 

• Processes that should be automated are done manually. 

• The employee who is supposed to perform the task is unqualified to perform it. 

The SSA managers are overwhelmingly willing to perfonn tasks that they feel are not their 
responsibility. However, it was also widely observed that taking on so many tasks outside of 
their job descriptions is hindering their ability to properly perfonn their own responsibilities (see 
Section 4.1.5 Allocation of Human Resources). 
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4.1.4.1 Issues 

Understaffed management is a primary reason that the organization is stuck in a mode of reacting 
instead of planning (see Section 4.1.2 Strategic Planning). The lack of planning has resulted in 
inefficiencies that put management even further behind. For example, shipyard planning, 
including the midlife refit of M/V Martha’s Vineyard, has suffered (see Section 4.2.4 Project 
Planning). 

Understaffed management has also resulted in inadequate quality control. For example: 

• Documents not getting reviewed by the appropriate people. 

• Inadequate oversight of major capital projects, including shipyard overhauls. 

The morale of the management team at the SSA has been negatively impacted, due to overwork 
and feelings of inequity amongst some employees who feel they are pulling more than their 
weight while others are underperforming without consequence. 

Understaffed management also limits the ability of upper management to adequately train those 
employees who may eventually be promoted into their roles. This is not only problematic in 
terms of limiting the ability for those upper managers to delegate their own responsibilities when 
necessary, but puts the organization at risk for when those upper managers leave the 
organization. 

4.1.4.2 Industry Standards/Best Practices 

Staffing levels should be adequate such that employees are engaged and productive without 
being burned out. 

Successful organizations provide their employees with ample support and training, but also 
recognize that sometimes underperformers need to be removed. 

Customer expectations need to be managed. The tradeoffs between cost, quality of service, and 
frequency of service need to be clear to the public. 

It is common in the maritime industry for organizations to realize some economies of scale 
within their management structure as the size of the fleet and/or demand grows. This comes with 
some important caveats, however. At the SSA, the factors limiting these economies of scale are 
inconsistencies in operations and a lack of management systems. 

Operational inconsistencies are partly due to the unique requirements of the two routes as well as 
the diversity of the vessels. An important consideration when maintaining a ferry fleet is “fleet 
standardization”. That is, if the composition of a fleet is similar then management and operation 
of that fleet is more efficient than if the composition of the fleet is diverse. Since the 
composition of the SSA’s fleet is mixed, efforts at all levels must be tailored in order to maintain 
the same level of service. 

When organizations grow their fleet they count on achieving some economies of scale as they 
expect that their staff can effectively manage more vessels of a similar or consistent class or 
service by utilizing the existing management systems. However, if these established 
management systems do not exist, it is not reasonable to expect the same levels of efficiencies. 

4.1.4.3 Specific Solutions 

The SSA can and should confidently hire one or two additional management staff in order to 
obtain adequate management capacity to efficiently perform its mission. 

The SSA should routinely invest in a study (conducted internally or by external consultants) to 
determine how its staff are actually being utilized so that it can redistribute roles and 
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responsibilities more efficiently. This management structure audit is described in Section 4.1.5 
Allocation of Human Resources. 

To leverage its latent economies of scale, the SSA should invest in management systems such as 
a safety management system (see Section 4.1.6 Health, Safety, Quality, and Environment 
Policies). The SSA should also invest in new technologies and automation to lighten the 
workload on its existing staff, such as an improved enterprise asset management system (see 
Section 4.2.1). 

4.1.5 Allocation of Human Resources 

The SSA managers are overwhelmingly willing to perform tasks that they feel are not their 
responsibility. On the one hand, this is an admirable characteristic and fortunate for the 
organization, because the practice was found to be widespread within the SSA. On the other 
hand, the pervasive misalignment between job title and role performed has enabled and even 
fueled the perpetuation of an inefficient allocation of resources at the organization. 

There is excellent employee breadth, flexibility, and willingness to take on other tasks within the 
SSA’s administrative team. The SSA can and should continue to harness the benefits of these 
cultural assets, while correcting the issues that inadvertently take advantage of them and even 
turn them into liabilities. 

4.1.5.1 Issues 

The degree to which the SSA employees are perfonning duties outside of their job descriptions is 
hindering their ability to properly and efficiently perform their own responsibilities. The 
disconnect between job title and job role also makes it difficult to manage employees time 
because their actual roles are unclear. 

Mismanaged work assignments can also result in deficiencies not being addressed because they 
are hidden. For example, if an employee is incapable of performing a task that is their 
responsibility, and nobody else is willing to perform the task, then this deficiency will be 
illuminated when the task is not completed (or is completed poorly). Although this example 
suggests other cultural issues (a lack of teamwork), the problem will at least be identifiable and 
can therefore be managed. On the contrary, if an employee is incapable of performing a task that 
is their responsibility and another employee does perform the task for them, the deficiency is 
likely to go unnoticed. The problem is likely to reoccur, and the cultural norm of one employee 
doing another employee’s work is reinforced, exacerbating the problem in the future. 

4.1.5.2 Industry Standards/Best Practices 

In order to properly manage the size and duties of a workforce, there must be good alignment 
between prescribed job roles and duties actually performed. Otherwise, it is difficult or 
impossible for managers to know if their human resources are being deployed efficiently and if 
they are staffed at adequate levels. Job responsibilities should be clear, and each employee’s 
actual duties should align well with their job description. If this is not the case, either the job 
description or the actual duties performed need to change. 

4.1.5.3 Specific Solutions 

In order to achieve better alignment between prescribed job duties for each job title and the 
actual work performed by those titles, the SSA needs to understand how each administrator is 
actually spending their time. There are two ways to perform this management structure audit: 
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1. Survey each employee for their best estimate of the amount of time they spend on each 
task or type of task. This can be done quickly but may have some inaccuracies. 

2. Implement a daily timesheet system to collect near-real time data on how each employee 
is spending their time. Require timesheets to be submitted at the end of each day or week 
recording how much time was spent on each task. Collect data for 8-12 weeks, until an 
accurate sample of each employee’s responsibilities has been collected. 

In either method, it is important to standardize time spent into a manageable number of clearly- 
defined categories and sub-categories, or “buckets,” to ensure data integrity and allow for results 
to be efficiently analyzed. For example, categories might include Vessel operations, human 
resources, office administration, accounting, infonnation technology, etc. Sub-categories for 
vessel operations might include discussions with vessel crew, vessel maintenance planning, 
vessel budget planning, etc. The goal is to create a manageable number of sub-categories that 
cover most of the daily work performed by the organization (aim for no more than 50 sub¬ 
categories that cover at least 90% of the daily work perfonned). “Other” or “General” 
subcategories can be added to each category to allow 100% of time to be recorded-just require 
that if that option is used, comments are included detailing how that other time was used. 

In either method, to obtain accurate and meaningful results, it is important that everyone 
involved understands the value of the process. Employees should not be evaluated on the results. 

Once the SSA has obtained reliable data on how time is actually used, the data can be analyzed 
to see how the organization actually functions, and to answer the following questions: 

• Are the right people perfonning the right job functions? 

• Are there duties that are currently spread around the office that can instead be 
concentrated on one or two specialists? 

• Is anyone overworked? Is anyone under-worked? 

• Are there job functions that should be added? 

• Are our job descriptions accurate? 

4.1.6 Health, Safety, Quality, and Environment Policies 

Health, safety, and environmental (HSE) programs are policies and processes that companies put 
in place to ensure that no hann is done to people or the environment as the company pursues its 
stated mission. As preserving these goals can be difficult and expensive, HSE policies must be 
implemented with mechanisms that provide independence from corporate chains of command, 
whose objectives are not always in alignment with HSE goals. Without such independence, 
commercial or mission-related pressures can undennine HSE objectives. 

Quality policies, which focus on systematic improvement of the processes a business uses to 
achieve its mission, also require independence from the business-focused chain of command and 
utilize similar policy frameworks as HSE programs. This commonality of purpose and 
implementation often result in combined HSQE programs. 

The SSA has no formalized HSQE program, and the policies in place that do address HSQE 
goals are inadequate. Specifically: 

• Health. Inadequate; for example, a lack of documented policies for meeting OHSA 
guidelines at Fairhaven Maintenance Facility. 

• Safety. Inadequate; some specific policies, such as lock-out/tag-out, are in use, but not 
within fonnal process or system. 

• Quality. Inadequate; no formal processes or system. 
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• Environmental Protection. The SSA appears to comply with specific environmental 
regulations that are applicable to vessels and facilities, but no formal process or system is 
in place. 

Obstacles to the SSA’s pursuit of HSQE goals were observed in several areas, including the lack 
of leadership in prioritizing these goals, the lack of resources dedicated to HSQE programs, and 
cultural attitudes . 

Lack of Leadership. The SSA senior management have not prioritized HSQE goals or 
communicated to the organization the importance of such goals. This is evidenced by the lack of 
a formal HSQE program. In many cases where HSQE activities were observed, the efforts were 
designed to meet minimum regulatory requirements. 

There is no comprehensive safety manual documenting SSA safety policies to be used 
throughout the organization, so what polices do exist are not available to personnel onboard SSA 
vessels, within the vessel maintenance facility, and at vessel terminals. An incomplete 
Operations and Safety Management Manual was developed in 1997 but has not been updated 
since, and according to most accounts, is not used. Similarly, an Engineering & Maintenance 
Safety Management Procedures Manual was developed, but never approved by management or 
officially released, although some specific policies in it are in use. Most employees were 
unaware of the existence of either manual. 

Individual managers have made attempts to establish policies and procedures independently 
within their own departments but those that were witnessed were mostly created without 
executive approvals and lack document control. 

Lack of Resources. The SSA does not have any employees/positions dedicated to health, safety, 
quality, and the environment (HSQE) management. Instead, efforts that are being made are 
spread around the organization as secondary duties with no real accountability or authority. For 
example, the facilities engineer has some responsibilities for ensuring environmental compliance 
of the facilities, however this position is also responsible for the maintenance and upkeep of 
numerous facilities. The amount of time the facilities engineer can devote to environmental 
compliance is tightly constrained, and the role is focused on compliance with specific 
regulations, not the pursuit of defined HSQE goals. 

Multiple employees across the organization expressed a desire for an HSQE position to be 
added, in order to mitigate latent environmental and safety risks that they feared could result in 
disaster. 

Cultural Attitudes. When questioned about the events that occurred in the spring of 2018, 
multiple SSA executives pointed out that the issues experienced were unprecedented in their 
breadth and severity, and largely a function of external forces (weather, shipyard problems) and 
unfortunate timing. Although they acknowledged specific internal failures and mistakes, they 
implied that the issues were the result of a ‘perfect storm’ of independently unlikely 
circumstances, without which the issues would not have occurred to the degree that they did. A 
common view among managers is that the SSA had successfully operated for many years 
without such problems, and now that the unfortunate events are in the past, the SSA will 
continue to operate for many years into the future without any similar events. This view 
suggests that no systematic changes to the SSA’s management of their operations are necessary 
to operate the fleet at an acceptable level of reliability. 

By contrast, our investigation suggests that the SSA may, in fact, have had good luck not to have 
had more frequent and severe incidents. This Tuck’ over the years may be attributed to the high 
quality and dedication of its employees. But as the pace of change in the industry increases, 
coupled with the increase in recent turnover at the SSA, they will likely experience more 
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frequent incidents. This is based on the breadth of quality issues observed, as evidenced by the 
example in the Issues section below. 

4.1.6.1 Issues 

Many, if not all, of the vessel-related casualties that occurred this past spring at the SSA could 
have been avoided if the SSA had an effective management system in place with stated health, 
safety, quality, and environmental protection goals. How such a system can prevent incidents 
can be explained by understanding two key elements of management systems that are not 
effectively in place at the SSA: hierarchical control and continuous improvement. 

Hierarchical control: Management explicitly defines the roles and responsibilities of all 
personnel, develops policies and procedures that prescribe how personnel perform their jobs, and 
builds a system of accountability that ensures that work gets done in the way that management 
has prescribed. 

All companies, including the SSA, use hierarchical structures to organize their work force, define 
roles and responsibilities, and enable day-to-day operations. Observations of the SSA’s 
operations suggests that what they do not do is prescribe how they expect vessel crews to 
perform their jobs. The SSA lacks a comprehensive set of policies and procedures that 
enumerate the expectations and define how routine tasks and operations should be performed. 
Without management prescribing the ‘best’ way for crews to perfonn their jobs, the organization 
is reliant upon the training and judgement of the individual watch standers to decide. This takes 
the control of quality outcomes out of the hands of management and gives it directly to vessel 
crews. 

Considering that this review of the SSA’s management identified serious shortcomings in crew 
operational training, and observed circumstances where new crew members were put on watch 
with little or no training, the need for the SSA management to take direct control of quality 
outcomes, versus relying on crew judgement, becomes more urgent. 

Continuous improvement: The management imperative to continually evaluate policies and 
procedures with the stated goal of improving outcomes, using a standardized framework. As 
implemented by quality management systems, continuous improvement often involves the 
proactive identification and analysis of instances where prescribed policies and procedures are 
found to be incorrect or ineffective. 

HSQE management systems manage risk by forcing organizations to identify any issue that 
could contribute to an undesirable HSQE outcome, understand how and why that issue came 
about, and adjust policies and procedures to protect against the recurrence of that issue. In nearly 
all cases, issues that are identified and reviewed would not, in and of themselves, lead to an 
undesirable outcome, but if they have potential to do so, given another system failure or mistake, 
then they are investigated and prevented from recurring. 

By systematically eliminating circumstances that could lead to undesirable outcomes, continuous 
improvement programs increase the resiliency of operations, adding levels of protection against 
undesirable outcomes and reducing the likelihood that operational mistakes or equipment failures 
(which inevitably will occur, even in the most diligently managed operations) will not result in a 
serious incident. 

It is the prevailing attitude among some members of the SSA management that the vessel 
casualties experienced in the spring of 2018 were the result of a confluence of external factors, 
bad timing, and bad luck; and that no systematic changes to the organization are required to 
prevent recurrence of such incidents. Our review of the way that the SSA manages risks 
associated with the maintenance and operation of their vessels suggests the opposite: that future 
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incidents are likely, based on the SSA’s lack of process related to the identification and 
correction of quality and safety issues in the area of vessel management. 

The following is a list of quality issues related to the March 17 th blackout of the M/V Martha’s 
Vineyard that were identified during the root cause analysis of that casualty. None of these 
issues, in isolation, would cause a casualty. All of these issues, however, represent breakdowns 
in the way the SSA manages quality and safety onboard their vessels. In the context of a 
functional HSQE management system, each one of the listed items would be considered a ‘non¬ 
conformity’, which would trigger investigation, corrective action to fix the problem and prevent 
future occurrences, and documentation that the issue was resolved. 

• Lack of vendor controls during the shipyard allowed non-critical alarms to be configured 
as generator shutdowns. 

• Lack of testing of generator controls allowed vessel to leave the shipyard without 
engineering management identifying the above issue. 

• Shipyard oversight failed to identify incorrect crimp on Generator #3 connection to the 
generator starter. 

• No procedure or checklist was in place to provide instruction to crew on how to restore 
the plant from a blackout condition. 

• Vessel crew failed to restart the fuel oil transfer pump when restarting the plant from a 
blackout condition. 

• The vessel was released to service after a major casualty with unidentified damage to the 
switchboard. 

• The vessel was released to service after a major casualty with inadequate operational 
review of the plant (e.g., fuel pump was not restarted). 

• Fuel transfer pump pressure gauge was ineffective. 

• There was no indication of fuel transfer pump running. 

• The change in fuel system configuration was not kn own by crew. 

• The change in fuel system configuration not known or evaluated by management. 

• Vessel crew did not recognize dropping fuel tank level until the ta nk was empty. 

• Shipyard specification drawings of the fuel system were incorrect. 

• Shipyard oversight of automation vendor failed to ensure that fuel level alarms were 
correctly configured. 

• The vessel was released from shipyard without having tested USCG-required fuel level 
alarms. 

• Vessel PSTP was incorrect - it did not include required low fuel level alarms. 

• Vessel was released from shipyard without having completed a comprehensive test of the 
modified alann and monitoring system. 

• PSTP used during the vessel’s COI was not USCG approved. 

• Crew lacked training on back-feeding power from EDG to main switchboard. 

• There was no procedure available to vessel crew on how to back-feed power from EDG 
to main switchboard. 

• One of the vessel’s two fuel transfer pumps had been electrically installed on a fuel 
supply circuit that was not isolated by the remote fuel shutoff. 

While many of these issues are typical details that all vessel operators struggle to manage, the 
number of issues that were identified in association with a single vessel incident suggests that the 
SSA’s operation has an unusually high level of unobserved or ‘latent’ issues, any one of which 
could contribute to a future incident. Since the spring of 2018, the SSA has resolved some of the 
specific deficiencies identified on this list. For example, the M/V Martha’s Vineyard PSTP has 
been submitted to, and approved by, the USCG. As a regulatory requirement, it was crucial to 
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address this with urgency. This investigation of the SSA’s operations discovered no sign, 
however, that the SSA was making any systematic changes to policies or procedures that would 
address the root cause failures associated with this incident. They have not, for example, made 
any fundamental change to crew training systems, engine department watch processes, or their 
approach to shipyard project management. This fact reinforces the observation that the SSA is 
focused, in large part due to a lack of resources, on meeting the minimum compliance standards 
rather than pursuing proactive improvement. 

4.1.6.2 Industry Standards/Best Practices 

Formalized and documented HSQE programs are mandated for passenger vessels operating in 
international waters under the ISM Code, and are common, but not required, among domestic 
ferry operators. Current best practices for ferry vessel operators of the SSA’s size is to have a 
formalized HSQE program implemented in an ISO quality management style and fully supported 
by leadership at the highest levels. 

A majority of organizations in the maritime industry, both globally and domestically, have 
identified the need to set and work actively to achieve HSQE goals. Most of these organizations 
have realized the benefits of using a management system to do so. The management systems 
employed take many forms and represent a variety of approaches tailored to the industry segment 
and individual operation, but they consistently follow the ISO format for management systems 
and ensure that the following functional requirements are accomplished: 

• A clear and concise policy is provided. 

• Communications protocols are established. 

• An individual independent of the chain-of-command is designated and given proper 
authority and responsibility to manage the system and ensure effective communication. 

• A means of verifying the effectiveness of the system is provided. 

Within the maritime community the ISM Code has been adopted to address safety and 
environmental protection management. Organizations have incorporated elements of the ISO 
9001 standard for quality management systems, as well as other standards, into their program. 
This has been a very effective way to address issues through a single platform, commonly 
referred to as a safety management system (SMS) or other name suitable to the elements 
incorporated. 

The ABS Guide for Marine Health, Safety, Quality, Environmental, and Energy Management 
(Reference 11) provides guidance on implementing an HSQE program in the maritime industry. 

The ISM Code and related code sections specific to the maritime industry that address safety, 
environment, security, and quality have been adopted by some of the nation’s largest ferry 
operators. While the ISM Code is not a regulatory requirement for domestic maritime 
operations, it is becoming an industry standard/best practice, adopted by ferry operators such as: 

• Washington State Ferries, since 1998. 

• Staten Island Ferries, since 2005. 

• HMS Ferries, since 2003. 

• NYC Ferry, since 2017 (ISO standards 9001, 14002 and 45001). 

4.1.6.3 Specific Solutions 

The SSA should strongly consider developing and implementing an externally-audited ISM 
Code-compliant safety management system (SMS) as a management system foundation. An 
SMS system, and the continuous improvement processes that come with it, would force the 
organization to identify quality gaps across the organization and track each to a resolution. This 
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system could then provide the infrastructure to support additional management programs to 
address quality, health, and other challenges they may face in the future. 

Developing and implementing an SMS requires human, financial and IT infrastructure resources. 
A designated person (DP) must be identified. The role of the DP is to facilitate communications 
between employees and management (a crucial element of the SMS), verify and monitor the 
system as it strives for continuous improvement, and coordinate and prepare for external audits. 
In order for the DP to effectively perform these functions they must remain independent of the 
chain-of-command, have direct access to the highest levels of authority in the organization, and 
be provided with adequate resources. 

A full time DP with administrative assistance is typical for an organization of this size. There is 
an inherent advantage to assigning this and only this role to a single individual. When 
individuals are responsible for both the short-tenn operational perfonnance of the organization 
and its long-term commitment to healthy, safety, quality, and the environment, the short-term 
operational perfonnance often conflicts and ovenides the HSQE goals. An employee dedicated 
to the title and given sufficient organizational independence would be able to support quality 
imperatives in the face of commercial and organizational pressure. The DP should report 
directly to the General Manager. 

4.1.7 Hero Culture 

The SSA is led by a small group of hard working individuals who spend significant portions of 
their time perfonning duties that are outside of their job descriptions. These individuals carry a 
significant amount of institutional knowledge (see Section 4.1.1), and in many cases they are the 
only employees capable of fulfilling certain duties. All of these observations are aspects of a 
pervasive hero culture: a culture in which the organization is overly-reliant on a small number of 
individuals. 

There are several factors fueling the hero culture: 

• The SSA workplace is highly visible and scrutinized by its customers. The appearance of 
hard work and long hours is celebrated by customers and the organization, even if the 
allocation of resources is grossly inefficient. 

• The SSA is laser-focused on cost-cutting. An unintended consequence has been to cut 
out its own ability to do adequate planning. 

• A hero culture creates a vicious cycle. While the culture of cost-cutting has resulted in 
vastly inadequate organizational planning, breaking out of the hero culture ironically 
requires significant planning. 

• Fighting fires is easier than planning. 

4.1.7.1 Issues 

There are numerous issues associated with a hero culture, including: 

• Being perpetually stuck in a reactionary “firefighting” mode. 

• The lack of process-based, institutionalized operations. 

• Difficulty managing people’s time, due to a disconnect between job titles and duties 
actually performed (see Section 4.1.5 Allocation of Human Resources). 

• A stressful, rigid work environment, where it seems like everyone is busy but nothing 
gets done or gets done well. 

• Resistance to change, planning exercises, or anything that gets in the way of the most 
urgent and visible needs. 

• Tribal knowledge - knowledge that is only known by a few employees. 
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• Lack of scalability, since knowledge and power is concentrated within a small group of 
“heroes.” 

• Lack of adaptability to evolving customer demands and industry dynamics. 

• Burned out employees and low morale, due to unrelenting workload and the feeling of 
wasted time due to inefficiencies. 

• Lack of oversight and increased risk for mistakes. 

• Lack of trust and empowerment, due to a lack of processes for sharing information and a 
lack of processes for institutionalizing how the organization operates. 

• Inefficiency due to employees performing tasks below their paygrade or that other 
employees are better suited to handle. 

• Self-perpetuation, because the hero culture is easier and more rewarding than planning. 

4.1.7.2 Industry Standards/Best Practices 

Mature organizations like the SSA should have documented processes for every job function that 
is required to deliver their product or service. In the marine industry, companies which have 
successfully adopted process-based operations are leading the industry in operational efficiency 
and customer satisfaction. 

No employee should be irreplaceable. This is critical to the reliability of the organization, but 
also a critical factor for breaking the self-perpetuating cycle of a hero culture. 

The SSA is a complex organization that requires a highly skilled and competent workforce to 
accomplish its objectives. However, there are many other ferry services of similar or greater 
complexity that do not suffer from the same levels of employee stress and fatigue that we 
observed at the SSA. 

4.1.7.3 Specific Solutions 

The SSA management needs to change from a hero culture to a process-based culture. Culture is 
the hardest thing for any organization to change, which is why it is often precipitated by a crisis 
followed by demands for change by the customers or shareholders. In this case, the SSA’s 
governing Board will need to closely oversee the implementation of the following solutions to 
ensure they are given the time, effort, and resources they require. 

The first step is to align the job duties for each job title with the work actually perfonned. This 
will begin to illuminate key processes and any inefficiencies in accomplishing them, and help to 
balance workloads. The basic process is described in Section 4.1.5 Allocation of Human 
Resources. 

The second step is to define the key processes that the SSA follows in order to accomplish its 
mission. This process mapping exercise will be a project of its own, requiring an internal 
champion or an experienced contractor. The processes will be broken into tasks such that 
somebody with reasonable qualifications and on-the-job training can perform them, and the 
organization chart will be mapped to the processes to define responsibilities. 

The SSA should also improve its communications to the public to better illuminate what it is 
doing to perform its mission. By providing reliable operations and good communications, the 
SSA should be able to eliminate the need for employees to routinely work well over 40 hours per 
week. 
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4.1.8 Institutional Knowledge 

Institutional knowledge is the wisdom held by an individual about how an organization or part of 
an organization functions. Institutional knowledge can be a tremendous asset to any organization 
if properly captured and managed. 

It was generally observed that there are many long-tenured individuals with significant 
institutional knowledge at the SSA. Although it goes without saying that having knowledgeable 
employees is a great asset for any organization, a negative side effect of being able to rely on 
institutional knowledge is that it can be over-relied upon, resulting in a lack of documented work 
processes. Evidence of this was observed at the SSA. This lack of documented work processes 
has a number of ill effects, including putting the organization at risk of unnecessarily relying on 
unique individuals, causing inefficiencies, and preventing change. 

The risks of this problem are amplified at the SSA due to the following related observations: 

• Management turnover. The SSA is currently undergoing a high degree of management 
turnover (mostly due to retirements), which is amplifying the amount of information that 
is being lost and highlighting a lack of redundancy in key management roles. 

• Changing environment. The industry and environment in which the SSA operates is 
rapidly changing, also amplifying the problem. 

• Inconsistencies in fleet. The SSA ferry system is complex, with little consistency 
amongst the vessel fleet, crews, and equipment. 

• Overreliance on memos. The primary mode of communicating new policies and 
procedures is with memos, which is not a reliable medium for document control and 
referencing. 

4.1.8.1 Issues 

The SSA is highly exposed to the risk of institutional knowledge loss when an employee leaves 
their job. With an aging workforce, especially amongst vessel crews, this issue will continue to 
amplify unless the overreliance on institutional knowledge is addressed. 

Relying on institutional knowledge can result in the acceptance of bad practices or “bad habits.” 
Institutional knowledge is resistant to the adoption of best practices, evolving industry standards, 
and programs of continual improvement. 

Relying on institutional knowledge is subject to a higher degree of individual interpretation than 
relying on documented standards and work processes. This results in inconsistencies and 
increases the opportunity for errors. 

4.1.8.2 Industry Standards/Best Practices 

Most industries, not just the maritime industry, are challenged by the overreliance on 
institutional knowledge. There are several standard approaches that can be employed to deal 
with the issue. Some common approaches are to: 

• Identify leadership competencies in existing employees, and train the next generation of 
leaders well before the jobs are available. 

• Ensure there is never just one person capable of performing any given job function within 
an organization. At a minimum, there should always be at least one backup. 

• Document business practices within living documents, which are updated as best 
practices emerge and evolve. 
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4.1.8.3 Specific Solutions 

The solution to an overreliance on institutional knowledge is to adopt the best practices detailed 
in the section above. At the SSA, this should start with documenting knowledge (how the 
critical functions of the business are performed successfully) and ensuring knowledge 
redundancy amongst the work force. 

Specifically, the SSA should document its work processes, beginning with those that are the 
most critical to meeting its objectives. Memorandums are currently the dominant medium for 
disseminating policy changes throughout the organization, but these are inadequate as they can 
easily be overlooked and do not achieve version control. Instead, the SSA should maintain a 
database of policies. Memos should only be used to alert employees of new or amended policies, 
and direct employees to the appropriate version-controlled documents. 

To ensure knowledge redundancy amongst its employees, the SSA should engage in succession 
planning, and ensure there is always at least one employee capable of filling every employee’s 
role. Employees in management positions should be held accountable for training those who 
replace them. The SSA should also consider developing formal mentoring programs to train the 
next leaders. 


4.1.9 Tenure 

The SSA management contains a high number of long-tenured employees, as illustrated in 
Figure 6. While there are numerous positive qualities associated with organizations that are able 
to retain employees, the SSA suffers from an overemphasis on the tenure of its administrative 
and executive team as a grounds for career advancement. 
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Figure 6 Tenure of the SSA executives 

An important and valid reason for promotion of long-tenured SSA employees is that longevity is 
highly correlated with experience and wisdom, which are valid measures of merit. However, 
some cultural problem areas inflate the importance of tenure at the SSA for the wrong reasons. 
The SSA is overly reliant on institutional knowledge (see Section 4.1.8 Institutional Knowledge). 
Long-tenured employees tend to be the most reliant institutional knowledge. 
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The SSA also has a hero culture which has concentrated knowledge and power in a small number 
of executive-level employees. This concentration of power results in organizational 
inefficiencies for many reasons (see Section 4.1.5 Allocation of Human Resources). 

Recruiting outside of the organization has been passive. For example, the Port Captain position 
has been open for a considerable time but has not been advertised externally, despite the fact that 
the SSA has only received one internal application. 

The competitive environment in which the SSA recruits its employees is an important 
consideration. The SSA headquarters is in Falmouth, MA - a small town with a high cost of 
living (96.2% above the national average, Reference 5). The maritime industry also offers high- 
paying private sector jobs, such as oil industry jobs in the Gulf Coast region. These salaries 
cannot be matched by the SSA. However, recent salary audits of the SSA show that 
management salaries are in line with comparable positions in other public service organizations. 
The SSA is also in close proximity to a strong maritime community, including Massachusetts 
Maritime Academy. And, the geographic region is generally considered a very desirable place to 
live. Considering all of these factors and discussions with the SSA HR Department, the SSA’s 
ability to recruit qualified candidates was not observed to be a major factor in the tenure of its 
employees. 

4.1.9.1 Issues 

Issues associated with the SSA’s overemphasis on tenure as a grounds for advancement include 
the following: 

• Merit underemphasized. The longest-tenured employees may be promoted instead of 
the best qualified candidates. This damages the performance and morale of the 
organization. In some cases, qualified candidates at the SSA did not even apply to 
positions out of deference to others in the organization who they believed were “next in 
line.” 

• Insularity. Fresh and outside perspectives are suppressed when there is a lack of hiring 
from outside an organization. Insular organizations experience difficulty adapting to 
their evolving surroundings. They are also at elevated risk of ‘groupthink,’ or making 
decisions as a group in a manner that discourages creativity and individual responsibility. 

• Toleration of underperformance. There was evidence of underperformance not being 
remediated at the SSA due to a lack of management will to confront long-tenured 
employees. 

4.1.9.2 Industry Standards/Best Practices 

Decision making can be improved when natural coalitions are broken up. By assigning people 
with different interests and roles and who do not normally work together to shared tasks, fresh 
perspectives and ideas come to light. Recognizing this when hiring and promoting can positively 
influence those decisions. 

Merit should be heavily weighted when making decisions about hiring, advancement, and 
incentive structures. Tenure is correlated with merit, so all else being equal, those with longer 
tenure have an advantage without the need to artificially inflate the value of tenure. 

4.1.9.3 Specific Solutions 

Greater emphasis should be made on recruiting outside of the organization for job vacancies, 
especially while the SSA continues to be managed by a core group of very long-tenured 
employees with limited experience outside of the organization. 
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In order to ensure that tenure is not overemphasized at the expense of merit, it is critical that 
management performance is tied to organizational perfonnance. The solution to this is for the 
SSA to develop perfonnance metrics on which its executive staff are measured on an annual 
basis (see Section 4.1.2). This starts at the top: the SSA’s governing Board needs to develop 
operational perfonnance objectives on which to evaluate the performance of the General 
Manager, Treasurer, Operations Manager, Director of Engineering & Maintenance, Director of 
Information Technology, and Director of Human Resources, at a minimum. 

4.2 Fleet Maintenance 

4.2.1 Engineering Policies and Procedures 

Evaluation of the SSA’s marine engineering operations included an investigation into what 
policies and procedures are in place and being utilized by the organization’s personnel. The 
following procedures were identified: 

• Procedures for the start-up of vessel machinery plants. 

• Procedures for the securing of vessel machinery plants. 

• A comprehensive Engineering & Maintenance Safety Management Procedures 
Manual. 

The vessel start-up and securing procedures were observed to be available onboard fleet vessels 
and generally in use, despite several shortcomings, including: 

Lack of document control. Policies were observed to have no revision numbering or date to 
allow for document control, or official fonnatting to suggest they are the current authorized 
procedures. 

Inconsistencies across fleet. Procedures were observed to lack standardization and consistency 
across the fleet with regards to format, content, degree of detail, and objectives. For example, 
inconsistencies in the vessel startup and securing procedures were observed between 
M/V Martha’s Vineyard and M/V Woods Hole. The Martha’s Vineyard procedures were highly 
descriptive and provided familiarization information, which may be useful to new and 
inexperienced crew members, but reduce the value of the procedure as a working checklist. The 
M/V Woods Hole procedures were written much more like a working checklist, but lacked 
instructive information for new and inexperienced crew members. In both cases, the procedures 
were written in an informal, conversational tone, and lacked document control. 

There was no evidence to suggest that the Engineering & Maintenance Safety Management 
Procedures Manual had been distributed throughout the organization, and procedures 
documented in this manual did not appear to be in active use within the organization. 

Discussions with engineering management indicated that the manual had never been officially 
released as policy, and was still under review by senior management, despite the revision date of 
June 2012. 

Instances where the lack of standardized procedures directly contributed to a vessel incident 
were also observed, as described in Section 3. These included the following examples: 

• In the aftermath of the generator fire on M/V Martha’s Vineyard, the crew was called on 
to restore the plant from a blackout condition. There was no procedure or checklist for 
this operational transition. If there had been a fonnalized procedure or startup checklist, 
or if the crew had followed the plant startup procedure, then the fuel transfer pump would 
have been restarted, and the March 17 th blackout would have been avoided. 

• The SSA failed to perform an effective investigation into the cause and effects associated 
with the fire that occurred on the M/V Martha’s Vineyard, and therefore failed to identify 
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latent damage to the switchboard and operational limitations that led to the blackout on 
March 17 th . If the SSA had a procedure prescribing how such investigations must be 
performed, or if the SSA had followed the casualty investigation policies outlined in the 
draft Engineering & Maintenance Safety Management Procedures Manual, then these 
limitations would have been identified and subsequent vessel casualties or service 
interruptions possibly avoided. 

• In the aftermath of the March 17 th blackout of M/V Martha’s Vineyard, the vessel was at 
anchor with the ability to only run the emergency diesel generator. Restoration of power 
to critical loads on the main switchboard were delayed because the crew did not know 
how to back-feed power from the emergency diesel generator to the main switchboard. 
The lack of a written procedure that was available to the onboard crew delayed the 
restoration of power and lighting to the vessel’s main switchboard, and unnecessarily 
demanded the attention of the vessel Chief Engineer and Port Engineer at a critical time. 

Multiple issues were observed with the periodic safety test procedures (PSTPs) associated with 
the SSA vessels. These procedures are special test documents that are explicitly required by 
regulation, which must be approved by the USCG Marine Safety Center (MSC), and performed 
to the satisfaction of the local Officer in Charge, Marine Inspection (OCMI) on an annual basis. 
The following problems associated with the PSTP for the M/V Martha’s Vineyard were 
identified during the investigation of casualties onboard the vessel. 

• The vessel did not have a USCG-approved PSTP at the end of shipyard period. 

• Prior to June 2018, the vessel’s PSTP consisted of several individual procedures for 
various systems, such as the propulsion control system and the alarm and monitoring 
system, instead of a single document. 

• The procedure for the alarm and monitoring system was not complete or accurate. For 
example, generator fuel pressure alann setpoints were not correct, and no fuel service 
tank level alarms were included. 

• The procedure that was, according to the SSA management, performed for USCG was 
not marked to suggest that it was approved, and did not include a test date or name of the 
tester. The procedure fonn has a field for witnessed by and date, but it was not signed. 

• The new, re-written version of the vessel’s PSTP appears to be incomplete and/or 
inaccurate. For example, it does not include low generator fuel oil pressure alarms. 

4.2.1.1 Issues 

The absence of clear policies and procedures presented in a consistent format and with a clearly 
communicated expectation that these policies and procedures will be followed results in vessel 
crews and maintenance personnel applying their own personal preferences, experiences, and 
judgement about how best to perform a task or conduct an operation. The variability of many 
unique approaches to the same job function creates possibilities for misunderstanding and 
mistakes. It makes it difficult for management to consider the various options and decide on an 
optimal procedure. The lack of consistency also reduces efficiencies that could be gained if 
everyone was doing things the same way and makes it difficult to reinforce good practices and 
identify and eliminate bad practices. 

A lack of policies and procedures also makes it difficult or impossible for vessel management to 
direct the actions of its crews. For example, the rate at which the M/V Martha’s Vineyard fuel 
service ta nk level dropped during the March 17 th incident was dramatically increased by the 
change in fuel system configuration that occurred prior to the incident and without the 
authorization of vessel crew management. If configuration of the fuel system was covered by 
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vessel operational policies and/or documented watch processes, then the incident may have been 
avoided. 

In the same way that vessel equipment operational policies ensure the safe operations of vessels, 
procedural approaches to engineering management processes ensure that critical job functions 
are accomplished, and that quality and performance goals are met. For example, many quality 
issues resulted from a lack of quality control procedures during the M/V Martha’s Vineyard 
midlife refit project. 

4.2.1.2 Industry Standards/Best Practices 

Vessel managers operating fleets the size and complexity of the SSA typically employ a 
formalized management system to document and control the policies and procedures that are in 
place in their organizations. These systems force operators to develop and implement policies 
and procedures for all operational and managerial processes. A more detailed discussion of how 
and why operators implement such programs is included in Section 4.1.6 Health, Safety, Quality, 
and E). 

4.2.1.3 Specific Solutions 

It is unlikely that the SSA will be able to prevent future occurrences of the kinds of casualties 
that were experienced in the spring of 2018 without making a cultural and managerial shift from 
informal policies and procedures that rely on the judgement of individuals to a formalized 
management system that prescribes procedures related to all aspects of vessel operations. The 
SSA should strongly consider developing and implementing an externally audited ISM Code- 
compliant safety management system (SMS) as the basis of and controlling mechanism for all 
policies and procedures (see Section 4.1.6 Health, Safety, Quality, and Environment Policies). 

Whether or not they are codified by an SMS, the SSA should develop a set of company policies 
and procedures that comprehensively define all critical tasks and processes that are required for 
the organization to operate safely and efficiently. The basic steps to implement these policies 
and procedures are: 

1. Identify all operational and managerial sequences whose perfonnance impacts vessel 
operations, condition, readiness, and reliability. 

2. Develop individual procedures that specifically address all operational, safety, and 
quality concerns regarding the particular task or process. 

3. Publish the policies in a standardized format and make them available to all personnel 
where they perform their work. 

4. Communicate the polices such that all personnel understand the details of the policies; 
confirm their understanding in writing. 

5. Establish feedback mechanisms that test the effectiveness of the policies and procedures 
and investigate all instances where they have failed to meet functional requirements (e.g. 
non-conformities, casualties, near-misses). 

6. Adjust the polices based on feedback to make them more effective. 

7. Control the policies so that changes are quickly communicated and adopted throughout 
the organization. 

The adoption of a policy-based framework for the management of the SSA vessel operations 
represents a departure from the organization’s current way of doing business. As such, it will 
require a cultural shift in both management and personnel to be efficiently and effectively 
implemented. Personnel are more likely to make the required cultural shift and embrace a 
policy-based framework when they are presented with convincing evidence of the value of the 
change. The implementation of new policies should include training that provides this evidence. 
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4.2.2 Engineering Resources 

Shortcomings in the SSA’s engineering operations identified by this investigation suggest that 
the SSA engineering and maintenance department may be understaffed for the responsibilities it 
is tasked with. The following three areas are particularly affected by this deficiency: 

a. Engineering department crew training (see Section 4.2.2 Engineering Resources for more 
details). 

b. Establishment and enforcement of vessel policies and procedures pertaining to engine 
room operations (see Section 4.2.1 Engineering Policies and Procedures for more details). 

c. Vessel repair, refit, and construction project planning and management (see Section 4.2.4 
Project Planning for more details). 

The following is a summary of responsibilities of the SSA Director of Engineering and 
subordinates, based on the SSA’s organizational chart, job descriptions, and observed 
functionality: 

• Engine department operations: Oversight of the day-to-day engine room operations of 
the SSA fleet, including the development and management of all engine department 
policies and procedures, and all efforts associated with unplanned vessel maintenance or 
other departures from standard vessel operations. 

• Personnel training: Development and execution of training programs for all engine 
department and maintenance personnel. 

• Asset maintenance: Planning and execution of preventive and corrective maintenance 
for all physical assets of the SSA, including vessel, terminals, facilities, and all rolling 
stock. This also includes the implementation and management of the SSA’s 
computerized asset management/maintenance system. 

• Management of maintenance division: Management of the SSA’s maintenance 
personnel and assets, including planning of vessel repair projects at the SSA facilities and 
all activities associated with purchasing, warehousing, and shipping and receiving for the 
warehouses. 

• Vessel repair projects: Planning and management of vessel repair projects conducted at 
external shipyards, including specification development, contracting, and regulatory 
interfaces. 

• Vessel construction: Planning and management of vessel construction projects including 
the management of design development, shipyard selection, contracting, and shipyard 
project management. 

• Regulatory compliance: Regulatory compliance of vessels and vessel personnel, where 
engineering/technical matters are relevant to the compliance. 

To discharge their responsibilities, the Director of Engineering has the following personnel 
available: 

• A Facilities Maintenance Manager, who is responsible for all facilities and 
environmental compliance for all facilities. This role has no direct involvement in vessel 
operations or maintenance. 

• A Vehicle Maintenance Supervisor, who is responsible for all rolling stock including 
22 buses. 

• A Vessel Maintenance Manager, who is responsible for a maintenance staff of 32 
including 3 foremen, spread across three facilities. 
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• A Port Engineer, who is responsible for engine department training and perfonnance, as 
well as fleet maintenance schedule planning, budget, and control. 

• An Assistant Port Engineer, who assists the Port Engineer and the Maintenance 
Supervisor, and is responsible for ensuring that the SSA’s computerized asset 
management system is utilized across the fleet. 

• A Project Manager, who is dedicated full time to the Woods Hole Terminal project. 

• A Maximo Planner, who is dedicated full time to the upkeep and management of the 
SSA’s computerized asset management system (Maximo). 

• An Administrative Assistant. 

• A Department Clerk/Secretary. 

• Contract employees, as needed. 

• Vessel crew, who are sometimes used to assist in shipyard project execution. 

This assessment suggests that all critical tasks associated with crew training, the establishment 
and management of engine department policies, and the planning and management of vessel 
repair and construction projects must be handled by the Director of Engineering and two 
additional FTE positions, the Port Engineer and Assistant Port Engineer, as well as the Vessel 
Maintenance Manager to assist with vessel maintenance planning. 

The SSA, as currently structured, lacks sufficient human resources in the area of middle-level 
engineering management to be successful in the discharge of assigned responsibilities, 
particularly in the three areas mentioned above. With a fleet of 10 aging vessels and a nearly 
constant rotation of those vessels through shipyard/repair periods, the effort associated with 
planning and executing these functions is far greater than what is currently available within the 
organization. 

The SSA has relied on external contractors to assist in the development of shipyard 
specifications and the management of large shipyard projects. This has helped the SSA manage 
the workload associated with these projects but has been insufficient to close the capacity gap. 

Discussions with various vessel crew suggested that the port engineers in particular are 
chronically over-committed, forcing them to ignore less urgent responsibilities. Numerous 
engineers indicated that they were reluctant to reach out to the Port Engineer, because they knew 
how busy the Port Engineer was. 

4.2.2.1 Issues 

It is difficult to attribute specific lapses by the SSA’s engineering management to problems 
associated with shortages in human resources as it is impossible to detennine what personnel 
would have done if they had had more time to perform their jobs. However, it is reasonable to 
conclude that the over-commitment of engineering management is a likely contributor to the 
organization’s recent vessel reliability issues. Maintaining the status quo puts the organization at 
increased risk for future such incidents. 

The engineering management team at the SSA appears to have the appropriate technical skills 
and background to successfully manage the engineering aspects of the SSA fleet. Yet, as this 
investigation has illuminated, the SSA has chronically neglected operational processes and 
critical engineering details in ways that have caused major vessel incidents. For example, two of 
the failures associated with root cause analyses performed as part of this study indicated 
incorrect implementation of vessel alarm systems modifications. Discussions with the vessel 
Port Engineers regarding shipyard projects suggest that, while they intend to be involved in 
technical details such as alarm system integration, their general lack of availability prevents them 
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from having anything more than a cursory involvement in such matters. Absent their 
involvement, such details fall to others who may not be qualified to provide the correct answers, 
such as the controls vendor or the crew assigned to the shipyard project. Or, worse, verification 
of these details is not accomplished at all. 

The Port Engineers and Director of Engineering are the individuals who are most closely 
involved with the response to, investigation of, and corrective actions associated with vessel 
casualties or unscheduled maintenance events. As such, any work that they are normally 
engaged in stops when they are needed to respond to emergent issues. During the organization’s 
extensive issues in the spring of 2018, all three of these individuals spent a substantial amount of 
their time reacting to unplanned events, not tending to their nonnal responsibilities. 

Interviews with all engineering management personnel suggest that the need to respond to 
emergent issues, and the general disparity between their work capacity and their assigned 
responsibilities, causes a prioritization of tasks that biases the manager’s attention to the urgent 
rather than the important. The general effect of this prioritization is that quality management and 
mid- and long-tenn planning are neglected. 

4.2.2.2 Industry Standards/Best Practices 

Comparisons in manning levels between the SSA and other ferry system operators are difficult 
due to the lack of comparable vessel operators, in terms of organizational structure, vessel 
operations, and business capitalization. That said, a comparison with publicly available data 
from Washington State Ferries (WSF) in 2011 (Reference 6) allows for some useful observations 
with a highly regarded ferry system. At the time that this organizational chart was released, the 
WSF system consisted of approximately 23 vessels and the following staffing levels: 

• 13 staff serving a Senior Port Engineer for Fleet Maintenance, with responsibilities for 
vessel crews and engineering operations. 

• 21 staff serving a Senior Port Engineer for Vessel Preservation, with responsibilities for 
vessel upgrade and repair projects. 

• 15 staff serving a Vessel Design Chief, with responsibilities for engineering associated 
with new vessel designs and modification of existing vessels. 

WSF is a larger organization with a different mandate, larger and more diverse operations, and 
vastly greater revenues. However, it is reasonable to conclude, by comparing the level of 
resources that each organization dedicates to engineering operations, training, and vessel project 
planning and management, that the SSA’s engineering management lacks sufficient resources. 
Also noteworthy is WSF’s separation of‘Fleet Maintenance’ crew responsible for operations, 
and ‘Preservation’ crew, responsible for vessel repair and upgrade projects. This deliberate 
segregation of responsibilities insulates planning and management efforts from urgent issues that 
can and do occur within the operations realm. 

4.2.2.3 Specific Solutions 

The following changes to the SSA management and practices would improve the organization’s 
ability to successfully discharge the responsibilities allocated to the engineering management 
team: 

• Increase the number of port engineers. 

• Dedicate port engineers to specific vessels and make them responsible for the readiness 
of all vessel engineering crew and equipment. 

• Create a project engineer position with responsibilities for the planning and management 
of vessel repair and modification projects. This position would interact with the vessel 
port engineers when planning projects, but the project engineer would be responsible for 
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all aspects of specification development, contracting, contract management, and quality 
control while being isolated from vessel operations. This position would be responsible 
for the successful execution of shipyard and repair facility projects, including outsourcing 
construction oversight services to third-party engineering firms. 

• Have all port engineers report to the Director of Engineering and Maintenance, who 
would set quality objectives and manage fleet-wide policies, but not be involved in the 
day-to-day operation of the vessels. 

See Section 4.1.3 Operations Structure for a more detailed discussion of the organizational 
restructuring suggested above. 

4.2.3 Enterprise Asset Management System 

Enterprise asset management systems (EAMS) are generally used by organizations to manage 
the maintenance of physical assets throughout their lifecycle. The SSA currently uses Maximo 
as its EAMS software, although the SSA management indicates that they are actively planning 
the transition from the Maximo EAMS to The Asset Guardian (TAG) computerized maintenance 
management system (CMMS). CMMS are similar to EAMS, although EAMS implementations 
can generally include a wider breadth of functionalities. The SSA management noted that they 
were planning the transition due to the recognized shortcomings of the current Maximo 
implementation, and the costs associated with upgrading it to meet their needs. Although many 
individuals within the organization mentioned that this transition was planned, the SSA did not 
seem to have started any implementation planning for this transition. 

The functions that EAMS/CMMS perfonn within organizations can vary widely. The 
observations discussed below are limited to the aspects of the SSA’s EAMS that have 
implications on vessel reliability and, to a lesser extent, organizational efficiency. Within these 
functions, a number of inadequacies with Maximo, and how the SSA utilizes Maximo, were 
observed. 

The following shortcomings of the Maximo system currently implemented at the SSA were 
observed: 

• Access to the system is limited to senior vessel crew only. An effective EAMS 
requires timely, two-way communication (information in and out of the system in near 
real time). Vessel crew members who should have access to the system do not. Only 
senior chief engineers and senior captains can log into the system. These senior crew 
members are then responsible for the dissemination/collection of all data to and from the 
Maximo, which is inefficient. 

• ‘After the fact’ Maximo entries. There are many situations where a planned or 
corrective maintenance task is performed, and then the item is input into Maximo 
retroactively. This differs from the intended work flow, where the EAMS initiates the 
task. 

• Loss of network connectivity. The way that Maximo handles loss of network 
connectivity makes the use of the system while underway on a ferry impractical. 

• Lack of preventative maintenance automation. The Maximo system is not configured 
to trigger preventative maintenance tasks based on operating hours, so vessel crews 
typically perform all hourly maintenance on equipment based on their own discretion. 

• Maximo is utilized more as an accounting tool than as an asset management tool. 

The most disciplined aspect of the current EAMS implementation is its use as a tool to 
track maintenance labor hours, not to perform any explicit asset management functions. 
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• No integration with spare parts inventory system. The SSA has an inventory system 
for consumables, but not for vessel parts. Repair and maintenance parts are ordered by 
the maintenance or vessel personnel, which fails to leverage the asset database to 
eliminate errors and gain efficiencies associated with maintenance planning and parts 
procurement. 

4.2.3.1 Issues 

The following issues with the SSA’s implementation of its EAMS were identified based on the 
observations discussed above: 

• Lack of preventative maintenance automation. An essential function of a properly 
implemented EAMS is the automatic generation of routine maintenance tasks based on 
running hours of equipment. This function is particularly important for the SSA’s 
vessels, where the most critical equipment ( e.g ., diesel engines for propulsion and 
electrical generation) have maintenance schedules that are largely based on running 
hours. As currently implemented, the SSA’s EAMS does not utilize a running hour 
feedback loop to trigger maintenance tasks. Vessel crews reported using hand-written 
logs in notebooks to track the maintenance of equipment such as diesel engines, which 
have significant maintenance requirements based on running hours. 

• Ineffective equipment history. A key function of an EAMS is to capture relevant 
historical information about equipment and present it to operators and maintenance 
personnel such that they are better able to operate and/or maintain that equipment. When 
well implemented, the equipment history functionality of an EAMS becomes a 
knowledge base detailing not only preventive and corrective maintenance history, but 
also practical information regarding manufacturer’s bulletins, clarifications to 
manufacturer’s manuals, and special considerations regarding equipment operation. 
Histories allow crew and maintenance personnel to identify and address trends in 
equipment repair, enabling them to improve equipment reliability. The existing EAMS 
does not have this complete functionality, for the following reasons: 

o Only senior chiefs and senior captains have access to the system. 

o The lack of integration with a parts/inventory system greatly limits the value of 
the equipment history information. 

o Only preventative and corrective maintenance history is captured by the system. 

It does not capture useful crew observations, such as modifications made to the 
system that were not due to maintenance, out-of-range readings and how they 
were remediated, best practices on operating the piece of equipment, 
manufacturer updates to part numbers, etc. 

o The systems in place to ensure maintenance history is captured are unreliable (as 
discussed in the following two bullets). 

• No integration with spare parts inventory system. Because the current EAMS has no 
interface to a parts inventory system, parts ordering is the responsibility of the person 
who is performing maintenance. This work flow is problematic for a number of reasons: 

o Allows for human error in ordering parts. 

o Does not account for impact to equipment availability associated with 
maintenance lead times. 

o Is inefficient, as maintenance personnel must repeatedly identify part numbers. 

o Does not leverage cost or time savings (e.g., ordering parts when they are needed, 
not when they are on sale). 

o Concentrates critical details in the hands of individual maintenance personnel, 
whereas those details should be contained within the system. 
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o Is not a documented system process, so it is unlikely to be consistently 
perfonned. 

• ‘After the fact’ Maximo entries. Entries into Maximo after the work is perfonned are 
outside the documented system process, and therefore are unlikely to be consistently 
performed. When ‘after the fact’ entries become the norm, the EAMS is at risk of 
becoming a documentation burden without substantial value. An observed example was 
that checkpoint maintenance on vessel generators was not triggered by planned 
maintenance items, but rather by the maintenance person who typically does that work. 

None of the root cause analyses, vessel inspections, or reviews of vessel readiness perfonned in 
association with this investigation suggested that inconsistent maintenance activities had 
contributed to any of the recent vessel availability issues. This suggests that there are individuals 
within the organization who are taking personal responsibility for ensuring that equipment is 
maintained to the manufacturer’s standards, independent of the processes inherent to the EAMS. 
This is a credit to the SSA personnel and certainly worthy of note, but also a sign that the 
organization is at risk if these individuals leave the SSA (see Section 4.1.1). 

4.2.3.2 Industry Standards/Best Practices 

With respect to asset management and equipment maintenance, the ISM Code specifically 
requires that vessel operators: 

• Identify critical equipment whose failure could impact vessel safety. 

• Plan, perform, and document the maintenance required to ensure the reliable operation of 
that equipment. 

• Periodically test the equipment and audit the systems that ensure the performance of 
maintenance on that equipment. 

Despite the fact that the requirements detailed in the ISM Code are not a regulatory requirement 
for the SSA’s fleet of vessels, the practical need for processes that mitigate operational risk by 
ensuring vessel reliability suggest that these requirements are industry standard for operators of 
the SSA’s size and represent best practices. 

The SSA is not the only operator to struggle with the implementation of a comprehensive and 
effective asset management system. Evaluation of similar ferry and small cruise vessel operators 
shows that, as important as these systems may be, they are difficult to implement and maintain. 

In April 2017, in response to high profile vessel casualties that were traced to equipment failures, 
Washington State Ferries contracted for outside consultants to review the effectiveness of their 
CMMS, recommend changes, and develop a Request for Proposal package for a new system. 

The effort to upgrade their systems is currently underway. 

Many of the key principals that a successful EAMS/CMMS relies upon, such as the need for 
documented processes, the concept of continuous improvement, and the shifting of responsibility 
for system operation from operators to managers, are also principles on which marine safety 
management systems (SMS) are built. Due to these commonalities, implementation of an 
effective EAMS may be easier in the context of a functional SMS, or put another way, 
implementation of an EAMS may be more difficult for an organization that does not have an 
active SMS. See Section 4.1.6 for further discussion of safety management systems. 

4.2.3.3 Specific Solutions 

The SSA’s stated plan to implement a new EAMS/CMMS is a positive step, and the added 
features and functionalities integral to their intended replacement system will address many of 
the issues highlighted here. However, implementation of EAMS or CMMS systems is 
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notoriously difficult and expensive, and the value of the system is greatly impacted by how well 
the implementation is executed. The following two critical pieces of advice are offered: 

• Make the required investment. Proper implementation often requires that implementation 
costs are much higher than annual operating costs. 

• The system must be implemented in a way that ensures the maintenance functionalities 
are not secondary to other management priorities, such as accounting. 

The SSA should ensure its new EAMS or CMMS includes the following: 

• System for ensuring that all planned maintenance is performed in accordance with 
manufacturer’s recommendations, and completion of all maintenance work is 
documented. 

• Availability of all technical information related to vessel systems and equipment 
(manuals, drawings, service reports, equipment history, etc.) to all vessel crew and 
maintenance personnel when and where they need it. 

• A mechanism for vessel crews and maintenance personnel to document any observed 
irregularities in the operation or maintenance of equipment, such that these irregularities 
are reviewed and either addressed by corrective action or noted in equipment histories. 

• Mechanism that allows all users to check the status of all items tracked by the system. 

For example, an item originates as a work request, becomes a work order, and finally 
becomes an equipment history item. 

• Features that prevent a single human error from impacting system effectiveness. For 
example, feedback loops should highlight areas where individuals have not completed 
work, or where entries into the system are incomplete. 

The SSA has not indicated any timeline for the implementation of the new EAM/CMMS. Until 
a new system is procured and implemented, the following interim solutions should be considered 
to improve the functionality of the existing system: 

• Implement a running-hour feedback loop from vessels to the Maximo planner, and begin 
triggering run-hour based maintenance activities on the actual run time. This will reduce 
the number of ‘after the fact’ maintenance entries and provide a check against missed 
maintenance. 

• Expand access to the Maximo system from senior chiefs and senior captains to all 
pennanent crew. 

4.2.4 Project Planning 

The way that the SSA currently plans and executes vessel construction, refit, and repair projects 
appears to be negatively impacting vessel reliability. This has resulted in SSA vessels returning 
to service from shipyard repair periods prior to adequate sea trials, equipment testing, and crew 
familiarization with new systems. For example, the SSA recorded 200 remaining outstanding, 
incomplete, or unacceptable items when M/V Martha’s Vineyard left its midlife refit at Senesco 
in the spring of 2018. Although it is typical to have some remaining ‘punch-list’ items, and 
many of the listed issues were cosmetic in nature, the sheer volume of the incomplete work 
represented by this list indicates that the vessel was accepted from the shipyard prematurely. 

The issue of vessels being returned to service prior to completing repair work and performing 
adequate sea trials was also noted by many of the SSA personnel interviewed. 

Investigation into the M/V Island Home’s delayed return to service after her shipyard period in 
the spring of 2018 indicated that the SSA had failed to utilize basic project management tools 
and conventions when executing the project. For example, there is no evidence that either the 
SSA or the shipyard developed a project schedule identifying critical long-lead-time materials, 
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project milestones, or task interdependencies. There is also no evidence to suggest that the SSA 
held any planning meetings with the shipyard in between contract award and the start of the 
project, even though the project relied on timely ordering of critical long-lead-time materials. In 
addition, formal production meetings with the shipyard were not held during the course of the 
project. 

Investigations of recent shipyard projects suggest that the SSA is failing to control critical 
technical details of systems installed and modified during vessel repair projects, and the lack of 
control is resulting in vessel casualties. For example, the following technical issues resulted 
from inadequate management of the M/V Martha’s Vineyard midlife refit: 

• Alann setpoints for the generator fuel low pressure alarms were set incorrectly. 

• Fuel service ta nk low level alarms were not functional at the end of the yard period. 

• Configuration of new generator controls included shutdown alarms that were not wanted 
by the SSA, not required by regulations, and did not serve any practical purpose. These 
shutdown alarms resulted in erroneous shutdowns of the generators. 

As is discussed in more detail in the root cause analysis sections of this report (Section 3), these 
technical issues contributed to vessel incidents. 

The SSA does not have a sufficient number of staff to properly manage major and concurrent 
shipyard projects, so they outsource some of the effort to external contractors. Projects were 
reported to be managed by a mix of SSA port engineers, vessel crew, and external contractors. It 
was observed that shipyard and repair project management roles and responsibilities were 
unclear, inconsistent, and in many cases insufficient. The reporting structure amongst the 
managing teams was also unclear. The following examples are provided: 

• Port engineers are the most appropriate internal staff to manage shipyard projects, 
however they are also the first-tier responders to emergent issues with the fleet. The SSA 
only has two port engineers, who are already over-committed (see Section 4.2.2). 
Therefore, it is unlikely that port engineers can adequately manage ongoing shipyard 
projects, which require consistent involvement. 

• The SSA’s use of vessel crew to support shipyard projects is complicated by labor 
seniority rules, whereby senior crew can ‘bump’ less-senior crew as vessels go into 
repair, which often occurs due to desirable compensation and schedule benefits of 
working on a shipyard project. Although there is ample evidence that vessel crew adds 
value to shipyard projects by providing useful insight into vessel history and best 
operational practices, the use of crew to manage shipyard projects is unlikely to produce 
favorable outcomes due to the lack of particular experience in areas including project 
management, contracting, and regulatory requirements. 

• During the M/V Martha’s Vineyar d midlife refit, the externally contracted project 

manager was unavailable at times but they were not replaced by the 

SSA during their absence. 

Both the M/V Martha’s Vineyard and the M/V Island Home were returned to the SSA from their 
most recent shipyard periods after the planned delivery date. The SSA management contends 
that these delays were, to at least some degree, due to the shipyard’s inability to perfonn the 
contracted work on schedule. Contracting tools such as liquidated damages, that penalize 
shipyards for non-performance and mitigate the risk that such delays pose to operations, were not 
effectively applied to either of these projects. 

The SSA’s vessel out-of-service schedules generally plan for an SSA repair period following a 
shipyard. This is good planning in that it provides a natural schedule contingency if shipyard 
periods extend past their planned completion dates. It appears, however, that allowing the 
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shipyard to ‘finish’ incomplete shipyard period work at the SSA Fairhaven facility after vessels 
leave the shipyard has become commonplace. 

4.2.4.1 Issues 

The following list summarizes the most critical issues identified in the observations above: 

• The SSA’s failure to utilize basic project management tools such as master schedules and 
status meetings during some shipyard projects limits their influence on project schedules 
and reduces their ability to put contingencies in place when schedules are threatened by 
external factors. 

• The SSA’s inability to track critical technical details during shipyard projects has 
contributed to vessel casualties, such as the March 17 th and May 5 th blackouts that 
occurred onboard the M/V Martha’s Vineyard. 

• Lack of testing after the installation and integration of new systems is allowing vessels to 
return to service with unresolved and unknown issues. 

• The SSA’s failure to plan and manage shipyard project scope and schedule creates 
situations where they must either cut corners and take on additional risk to get vessels 
back into operation, or delay vessels and miss scheduled service. A combination of these 
choices has been made by the organization historically, which has resulted in both vessel 
casualties and schedule complications. 

The ability of the SSA to return vessels from shipyard and repair periods to revenue service on 
schedule is critical to the SSA’s operation. Shipyard schedules, however, are difficult to 
manage. Where project schedule delays can threaten vessel operational schedules, vessel 
managers typically employ contracting tools, such as liquidated damage provisions in shipyard 
contracts, to mitigate the risk that shipyards do not perform as expected. Although they require 
careful planning and diligent project management to maintain the documentation stream required 
to support liquidated damage claims, these provisions are very effective in mitigating the risk of 
shipyard non-perfonnance. At a minimum, these provisions motivate shipyards to maintain 
schedules and hold shipyards accountable for mistakes that may affect vessel delivery. Although 
contract provisions such as liquidated damages have been included in some of the SSA’s 
shipyard contracts, shipyard project management has been unable to leverage these tools to hold 
shipyards accountable for schedule growth. 

The lack of a project schedule for the M/V Island Home shipyard period prevented the SSA from 
holding the shipyard accountable for delays. The M/V Martha’s Vineyard mid-life refit included 
a liquidated damages clause in the shipyard contract, and schedule changes were tracked during 
the course of the project, but there did not appear to be a connection between the specific change 
orders and schedule extensions. Instead, a 14-day extension to the delivery schedule was granted 
to the shipyard on November 7 th , at no cost and without connection to any additional work. As 
typically applied, whenever ‘change’ work (e.g. work outside the scope of the original contract) 
is proposed to the vessel owner, it is proposed with both a dollar cost and a schedule impact. For 
the SSA to leverage contract provisions to maintain project schedules, they must manage both 
schedule and budget together. 

The routine practice of allowing shipyards to complete work at the SSA Fairhaven repair facility 
after the vessel departs the shipyard is problematic in that it removes the urgency that the 
vessel’s departure places on the shipyard, and may obfuscate responsibilities for completion of 
work, quality control, and testing while both shipyard and the SSA personnel work on the vessel 
at the SSA facility. 
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4.2.4.2 Industry Standards/Best Practices 

Shipyard project management is very hard to do well. It requires diligent control and attention to 
details, and the negative effects of badly managing projects are often not evident until long after 
the shipyard project, when an incident occurs. The requirements of shipyard project 
management demand adequate staffing levels, and are better suited for employees with project 
management experience or training, who are good at multi-tasking, have a breadth of knowledge, 
and have good attention to details. 

Vessel repair shipyards are low-margin businesses, with large cost uncertainties. As such, it is 
very easy for them to get behind on projects. When working with a shipyard that is ‘behind,’ the 
project manager needs to be very careful to control impacts to schedule, quality, and cost. 

Where vessel schedule is critical, vessel managers typically include liquidated damages into 
shipyard contracts to mitigate risk of delayed project completion. 

Contingency schedule and budget should be incorporated into any major maintenance project 
and shipyard period to accommodate additional scope, due to the nature of ‘discovery.’ For 
example, it is common to find wasted steel after removing deck coverings or joiner bulkheads. 
This is work that cannot be precisely and explicitly planned for, and cannot be deferred once it 
has been discovered. 

4.2.4.3 Specific Solutions 

By changing the way that they plan and manage shipyard and repair projects, it is likely that the 
SSA can substantially improve project quality outcomes, reduce the incidence of impactful 
delays, and exert more control over external factors that threaten project schedules. The 
following changes to current practices are recommended: 

• Train all personnel tasked with managing shipyard and repair projects in project 
management fundamentals; consider Project Management Professional (PMP) or similar 
certification. 

• Dedicate a full-time employee to the management of shipyard and repair projects. This 
individual would be fully responsible and accountable for the success of all such projects, 
and manage all of the SSA and/or subcontracted resources allocated to each project. This 
recommendation, which is discussed in more detail in Section 4.2.2 Engineering 
Resources, would leverage the fact that the SSA vessels are continuously rotating through 
shipyard/repair projects to develop particular expertise in the area of shipyard project 
management within the SSA. 

• Utilize contract provisions such as liquidated damages to mitigate risk associated with 
vessel shipyard projects. 

• Include adequate budget and scheduled contingencies in all shipyard projects. Favor the 
use of data and external references over internal judgement when determining 
contingency levels. 

• Implement processes that provide effective oversight of shipyard project managers at the 
senior management level. This oversight should include systematic review of critical 
project documents, such as technical specifications, project schedules, and risk analysis 
summaries. 

• Maintain rigorous schedule control throughout shipyard projects starting with clear 
statements of schedule requirements to potential shipyards in pre-contracting phases, and 
continuing with regular updates of shipyard-developed project schedules from contract 
award to project completion. 

• Introduce management processes that review shipyard projects after their completion and 
allow the SSA to leam from specific successes and failures within each project. 
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• Utilize vessel crews as project support personnel appropriately. Investigations into past 
shipyard projects suggest that crew involvement is extremely valuable when crews with 
the correct experience and skill sets are allocated to projects, but less so when personnel 
are selected based on seniority alone. 

• The SSA should require that shipyards develop specific test procedures for all new and 
modified equipment, and allow for the SSA to review such procedures well in advance of 
actual testing. 

4.2.5 Engineering Risk Assessment 

The SSA engineering management does not adequately account for risk when making decisions 
affecting the operation, readiness, and maintenance of fleet vessels. The SSA also lacks 
management processes that organizations typically use to manage risk systematically. Such 
processes provide checks on decision makers such that no individual is able to expose the 
organization to undue risk by virtue of their position or authority. 

There are several examples of situations in which the SSA’s operational decisions did not appear 
to have adequately considered the prevailing risk. 

Engineering Resources. As detailed in Section 4.2.2 Engineering Resources, the SSA does not 
appear to have the resources in place to support the current vessel shipyard, repair, and overhaul 
schedule. Although management generally acknowledged this lack of resources, their actions 
indicate a preference to accept the risks of inadequate resourcing rather than relaxing the 
schedule or adding personnel. For example, when a port engineer left the organization in 2010, 
management temporarily eliminated the position in order to save money. The position was not 
re-instated until 2016. A risk analysis of the effect of losing this position on the readiness and 
reliability of the vessels is unlikely to have indicated that the elimination of this position was 
acceptable on even a temporary basis. 

Vessel Return to Service following Repair Periods. In numerous independent conversations, 
crew members and other personnel of the SSA expressed discomfort with the condition in which 
vessels are commonly allowed to return to service following a shipyard or repair period. 
Although no direct connection was identified between incomplete shipyard work and the vessel 
incidents that occurred in the spring of 2018, the extensive list of unresolved discrepancies 
recorded as the M/V Martha’s Vineyard departed the shipyard does corroborate the discomfort 
reported by the vessel crew. 

The root cause analyses performed in association with casualties suffered by the M/V Martha’s 
Vineyard shorty after her return to service indicate that problems with the vessel alarm system 
contributed to those casualties, and points to the lack of comprehensive system testing prior to 
the vessel’s release to service as a causal factor. 

These observations suggest that the SSA has, in the face of pressure to maintain vessel operating 
schedules, allowed vessels to return to service before they are ready. These observations also 
suggest that the SSA makes such decisions not based on a systematic review of vessel readiness 
or considered risk analysis, but based on an individual’s evaluation that the vessel is seaworthy 3 . 

Crew Training. Another circumstance in which the SSA was observed to underrate operational 
risk was related to the training of crew. As is discussed in more detail in Section 4.3.1 Crew 
Training, shortcomings in the SSA training processes allowed vessel crew to be placed in 
situations where they were required to operate equipment on which they were not sufficiently 
trained. The most notable training gaps resulted from new crew not receiving sufficient training 


3 Used in this context, a vessel is seaworthy if it is reasonably fit for its intended use. 
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when joining a vessel, and from the SSA crews not receiving training when new systems or 
equipment were added to existing vessels. 

Ensuring that crew members have adequate training to operate the SSA vessels is made 
particularly difficult due to several factors that are unique to the SSA: 

• Most of the SSA vessels have three separate crews assigned at any given time. 

• The SSA’s fleet is very diverse, with unique systems, equipment, and configurations 
that may require specific training or familiarization on each vessel. 

• Rotation of crews between vessels is common. 

• The addition of new crew members to the SSA system is also common. 

The chance that the safe operation of the SSA vessels may be entrusted to crews who lack the 
training to properly perfonn their duties is clearly a risk for the SSA. Lack of training was 
identified as a contributing factor in three of the four root cause analyses performed on recent 
vessel incidents. 

The fact that the SSA has no formalized vessel training or familiarization process to ensure that 
crews are fully trained on vessel-specific equipment and systems before they assume a watch 
suggests that the SSA management has not evaluated the risk associated with training gaps, or 
actively considered the challenges that face the organization when planning for crew training. 

Investigation of Casualties. Vessels were also observed to be returned to service after casualties 
without adequate investigations to ensure the underlying issues causing the casualties were 
resolved. For example, on March 17 th of 2018, the M/V Martha’s Vineyard was returned to 
service only hours after two blackouts and a fire in a machinery space, without any substantive 
investigation into the causes or effects of the incident. As is discussed in more detail in RCA 
Sections 3.4 and 3.5, the SSA’s failure to adequately investigate the matter allowed the vessel to 
be returned to service with unidentified damage to the switchboard, and operational limitations 
that led to another blackout. This example and others suggest that the SSA’s only salient 
criterion for detennining when a vessel is ‘ready’ to be returned to service is the USCG’s 
pennission to return it to service, and that no practical assessment of the risks is performed in the 
aftermath of such incidents. 

4.2.5.1 Issues 

The observed shortcomings in the way that the SSA manages risk associated with vessel 
operations are summarized as follows: 

• The SSA does not have a safety management system (SMS) or other management 
processes in place to systematically manage risk and provide safety and quality 
backstops. In an environment where no such backstops exist, the decisions that 
individual managers make have the potential to expose the organization to unacceptable 
risk. 

• The SSA managers have made critical mistakes in assessing and addressing risk, 
particularly in circumstances where a manager was under commercial pressure to return 
a vessel to service. These mistakes have contributed directly to vessel casualties, as in 
the case of the March 17 th blackout of the M/V Martha’s Vineyard, in which the vessel 
was released to service after a major casualty with unidentified latent limitations that 
resulted in a blackout underway. 

• USCG permission to sail should be seen as a minimum assurance, not the end goal. 
Nobody, including the USCG, knows the SSA’s operation as well as the SSA crew, 
maintenance personnel, and vessel management. The USCG has limited resources and is 
limited in its ability to assess every situation with the multitude of operations and vessels 
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they are tasked to inspect. The SSA is lacking clear criteria for ensuring vessels are 
ready to return to service after a casualty or maintenance work based on its intimate 
knowledge of its own vessels and operations. 

4.2.5.2 Industry Standards/Best Practices 

Organizations of the SSA’s size and complexity typically use formalized management processes, 
such as job safety analyses and safety management systems, to systematically manage risk. 

These processes limit the degree to which any individual can incur risk through their discreet 
decisions by prescribing how high-risk activities are managed and implementing programs that 
specifically prevent circumstances that have been identified as high risk. For example, a 
formalized training program that requires verification that a crew member has completed vessel- 
specific familiarization training prior to their being assigned to a vessel systematically prevents 
crew members from being accidentally assigned to vessels for which they are not properly 
trained. 

These processes provide all levels of management with clear “sail/no sail” criteria where 
individual judgement may understate risks, such as in the areas of vessel seaworthiness, crew 
training, and equipment maintenance status. 

The utilization of a dedicated health, safety, quality, and environmental (HSQE) director is 
common for an organization of this size (see Section 4.1.6). 

Adequate engineering resources are necessary to mitigate the multitudinous risks to the 
reliability of vessels when being newly constructed or subject to midlife refit. See Section 4.2.2 
for best practices on adequate staffing of the engineering department. 

4.2.5.3 Specific Solutions 

The SSA should institute mechanisms that provide checks against individuals who are able to 
take on undue risk for the organization by virtue of their position and the SSA’s organizational 
structure. Suggested mechanisms are: 

• Risk assessment protocols that include proactive identification and consideration of 
operational risks. 

• Implementation of a safety management system (SMS) and quality management system. 
Such systems, if properly implemented, would include processes and provide backstops 
which would effectively prevent any individual from incurring undue risk onto the 
organization (see further discussion of a safety management system in Section 4.1.6 
Health, Safety, Quality, and Environment Policies). 

• The designation of an individual or individuals within the organization who are 
responsible for the identification and mitigation of risk. This role should be independent 
of the vessel operations chain of command and insulated from commercial and 
operational pressures to the greatest degree possible. 

The SSA should evaluate the staffing level of its engineering department (see Section 4.2.2 
Engineering Resources). 

The SSA’s mission statement should include safe operation of the vessels and be actively and 
persistently communicated to all of its employees, as a step towards shifting the organizational 
culture towards safety above all else (see Section 4.1.1 Mission Statement). 
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4.3 Vessel Operations 


4.3.1 Crew Training Program 

An examination of the documentation provided by the SSA indicated that the route-specific 
“Pilotage Workbook,” “Vessel Systems and Training Manual,” and “Vessel Operations and 
Training Manual” do not address recency (how long ago an employee received the training) and 
are not tailored to address vessel-specific operating procedures. 

On-site field observations and an examination of the provided documentation indicate that 
training is inadequately documented. While a manual system is in place to document training of 
new hires using an Excel spreadsheet, it was just recently implemented and is labor intensive. At 
any given time, it is not known who has completed what training and the recency of any relevant 
training. Interviews of some newer crew members revealed that they had never received any 
training. 

Interviews with the SSA personnel indicated some specific incidents, including: 

• A report of a late departure due to the engineer’s lack of knowledge regarding main 
engine start up. 

• Reports of personnel being transferred to vessels they haven’t operated for long time, 
without adequate re-training. 

4.3.1.1 Issues 

The SSA’s training programs have not kept pace with new vessels and new technologies. The 
current systems rely on regulatory requirements for training, which do not keep pace with the 
rate of change of technology and industry best practices. Regulatory requirements should only be 
considered a minimum standard. 

Furthermore, no vessel in the SSA’s fleet is alike, which increases training requirements and the 
resources to develop and implement them. Some SSA vessels are new and/or utilize new systems 
and technology. Distributing crew assignments to personnel who are not properly familiarized 
with the vessel and its equipment increases the risk of accidents. 

4.3.1.2 Industry Standards/Best Practices 

New industry standards have been established through the International Convention on Standards 
of Training, Certification, and Watchkeeping for Seafarers (STCW). These standards are heavily 
focused on training and development of formal training programs. Many of the larger ferry 
operators in the US and abroad have developed comprehensive training programs and Learning 
Management Systems. These systems are designed to evolve with the fleet and changes in 
manning requirements, equipment, and technology. They track progress by individual crew 
members and provide a feedback loop to promote continuous improvement. 

4.3.1.3 Specific Solutions 

A comprehensive training program should be developed. The following guidelines are 
recommended: 

• Establish a company directive to address training requirements. 

• Ensure operating procedures are vessel specific. 

• When a new vessel is acquired or when substantial modifications are made, establish a 
change process that evaluates all modes of operation and maintenance. Develop vessel- 
specific procedures for each. 


Comprehensive Review of the Steamship Authority’s Operations 


77 


13 December 2018 




• When personnel are transferred to new assignments, provide proper familiarization with 
the vessel and the equipment they will be operating. 

• Establish recency requirements for all training and familiarization processes. 

• Establish a routine audit process that identifies training gaps and ensures procedures are 
implemented. 

• Develop a training program which tracks training completed by each employee. 

4.3.2 Watch Processes 

For the purposes of this evaluation, Engineering Watch Processes are defined as the policies, 
procedures, and practices that detennine what engine room personnel do while they are standing 
a watch. These processes typically define details of activities such as: 

• Watch rounds. Who makes rounds of the plant equipment, when they perform their 
rounds, and what particular checks are made. 

• Watch readings. What plant process data is recorded during watch rounds, where and 
how it is recorded, what methods (if any) are used to identify abnormal readings. 

• Log book conventions. What plant process data and watch operational information is 
recorded and how it is recorded. 

• Plant configuration conventions. How and where infonnation about the status of 
variable plant configuration information is maintained, such as ‘#1 pumps on’, 
‘transferring fuel’, ‘#2 SS air compressor OOC for maintenance’, etc. 

• Watch responsibilities. What the performance expectations and responsibilities are for 
each watch stander. 

• Watch turn-over conventions. The protocols associated with watch turn-overs during 
vessel operations. This includes exactly when a tum-over takes place, how long the 
overlap between out-going and in-coming watch standers is, and what information is 
passed on from watch to watch. 

These ‘Watch Processes’ essentially represent all the things that watch standers do during a 
watch and how they do them. 

Log book conventions. None of the SSA’s vessels utilize a formal log book to document engine 
room watch activities or operations. The official log book that is utilized is a dated notebook, in 
which the watch engineer records plant start-up, equipment change-over, equipment hours, fuel 
soundings, and various operational activities (bunkerings, maintenance, troubleshooting, etc.). A 
typical example of a log book page is presented as Figure 7. The type of information that is 
recorded is generally consistent across vessels and crews, but even cursory review identified 
inconsistencies and omissions in the log keeping of some vessels. 

No actual plant process data is recorded in the engine room log books other than daily engine 
hours and fuel totals. Operational information that is typically recorded in log books is also 
absent, such as watch tum-over. Plant start-up is generally recorded, but plant shut-down, which 
is arguably just as important, is almost never recorded. 
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Figure 7 SSA engine room log book, M/V Martha’s Vineyard, sample page (names redacted) 

Watch readings. The watch engineer does not record any plant process data as part of their 
watch. Watch oilers do take readings during rounds, using official SSA forms, such as the one 
shown in Figure 8. Review of a limited number of watch round sheets suggest that the accuracy 
and consistency with which these round sheets are recorded varies. For example, in the hours 
before the May 5 th casualty on M/V Martha’s Vineyard, the critical parameter that was out of 
range and indicative of an impending failure, generator final fuel pressure, was not recorded on 
the day of the casualty, despite the fact that it had been recorded in the preceding days by all 
three watch oilers assigned to the vessel. 

There is no evidence to suggest that the watch engineers consistently review the watch oiler log 
sheets. In the previous example, despite a field on the log sheet for the Chief Engineer’s 
signature, there were no signatures on the sheets that were reviewed. 

Plant configuration conventions. Most vessel propulsion plants have some configuration 
variability that changes on a regular basis. For example, plants with redundant auxiliary 
equipment may rotate from #1 pumps to #2 pumps on a weekly basis. Vessels with multiple fuel 
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or water tanks may change from one active tank to another in accordance with operational needs 
or established conventions. Where operators make changes to such variable plant configurations, 
they are typically recorded on control room wipe boards or by similar means. 

The SSA vessels utilize such configuration ‘wipe boards’, and vessel crew reported established 
conventions regarding the rotation of vessel equipment. There did not appear to be any 
documented policies regarding these communication tools or equipment configuration 
conventions. These practices all appeared consistent with what is typical of vessels similar to 
those operated by the SSA. 

The investigation team did observe one notable issue regarding the communication of plant 
configurations, however. As is discussed in more detail in the M/V Martha’s Vineyard March 
17 th blackout root cause analysis summary, Section 3.4, a change in the configuration of the fuel 
piping contributed to the vessel casualty. Although the specifics of when and under what 
circumstances the configuration change was made, it is clear that neither the vessel crew onboard 
at the time of the casualty nor the SSA engineering management were aware of the change. 

Watch responsibilities. Vessel operations that utilize two-person engine room watches typically 
assign different roles and responsibilities to the two members of each watch. In general, such 
watches allow the main control room or operating platform to be manned constantly, while the 
two watch standers alternate making rounds of the engine space. The watch engineer (or senior 
watch stander) is typically responsible for the overall operation of the plant, and for ensuring that 
their subordinate conducts their watch properly. The watch oiler (or junior watch stander) 
typically will take the watch readings and report anything unusual to the senior watch stander. 

Although the investigation team’s observations of the SSA vessel engine room watches 
suggested that their engine department crews generally follow these conventions, the 
organization has no written policies that indicate what their expectations are for watch standers, 
or define the responsibilities of either watch team member. 

Watch turnover conventions. Watch turnover practices at the SSA were not sufficiently 
observed or investigated to make any statements regarding the practices in use onboard SSA 
vessels. 

4.3.2.1 Issue 

Two of the four vessel incidents that were investigated by means of root cause analysis resulted 
from situations in which vessels operated for an extended period of time with latent issues that 
would result in a blackout if not recognized and corrected by vessel crew. In both cases, the 
crew failed to recognize the hidden issue, and the vessels did, indeed, black out. 

The first such incident was the March 17 th blackout of the M/V Martha’s Vineyard, in which the 
fuel oil day ta nk dropped slowly over a period of many hours until the ta nk was completely 
empty. The other incident was also on the M/V Martha’s Vineyard, when on May 5 th the fuel 
pressure to the running generator dropped slowly over a period of two days until it caused the 
generator to shut down. 

It is reasonable to expect that a well-trained engine room watch would notice a nearly empty fuel 
service ta nk or a generator being starved of fuel oil. However, to conclude that these casualties 
were the result of inept or incompetent crew is neither accurate nor constructive. Such a 
conclusion prevents the organization from using these incidents as learning experiences from 
which they can improve the quality and safety of their operations. Other factors that should be 
considered before placing blame for these incidents on vessel crew include the following: 

• While it is reasonable to expect that well trained crew members would be able to 
recognize the latent issues associated with these two vessel casualties, the SSA does 
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not provide vessel-specific training or familiarization (see Section 4.3.1 Crew 
Training Program). 

• In the case of the May 5 th blackout of the M/V Martha’s Vineyard, all three crews 
associated with the vessel stood watch while the fuel pressure to the generator was 
operating below the normal range. One watch stander failing to notice an abnonnal 
plant condition may suggest that the individual may bear some blame for the lack of 
recognition of a problem. If all six watch standers associated with a vessel fail to 
notice the abnormal plant condition, this is indicative of a systematic problem that is 
preventing any crew from recognizing the issue. 

• The failure of the watch standers to recognize these latent issues was not the cause of 
either of the two blackouts, but rather missed opportunities to prevent them. In both 
cited examples, numerous other factors contributed to the casualties (see Section 3.5 
May 5th Blackout of M/V Martha’s Vineyard). 

A more analytical evaluation of why watch standers did not notice or appreciate the abnormal 
conditions that portended the vessel casualties in these two situations suggests that: 

• The watch standers did not observe the relevant critical parameters as part of their watch 
rounds. 

• The watch standers did not read the relevant critical parameters correctly. 

• The watch standers did not realize that the value they observed for a critical parameter 
was out of range. 

At least one of these factors must have been true in both M/V Martha’s Vineyard blackout 
casualties. This suggests that the watch practices in place at the SSA are not forcing watch 
standers to accurately observe and evaluate plant critical parameters. 
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4.3.2.2 Industry Standards/Best Practices 

The following description of a typical two-person engine room watch is provided as a point of 
comparison to the watch processes in place onboard SSA vessels. 

The Oiler (or junior watch-stander, referred to here as the ‘Oiler’) is responsible for making 
rounds of the machinery space, taking ‘readings’, and reporting anything abnormal or unusual to 
the Engineer (or senior watch-stander, referred to here as the ‘Engineer’). The ‘readings’ are 
recorded on a watch round form that is designed by engineering management and includes all 
critical plant parameters. The SSA “Generator Daily Log” sheets seen in Figure 8 are a 
reasonable example of such a form, but only cover generator critical parameters, where watch 
round forms would typically include readings from all plant machinery. After making a round, 


Comprehensive Review of the Steamship Authority’s Operations 


82 


13 December 2018 











the Oiler delivers the completed watch round form to the Engineer, and reports anything that was 
observed to be unusual. 

The Engineer is responsible for making their own rounds of the machinery space, for completing 
the official log book for the watch, and for ensuring that the Oiler perfonns their duties properly. 
The Engineer reviews the readings recorded by the Oiler on the watch round form and points out 
any errant readings to the Oiler, so that they can re-check those particular parameters. It is very 
typical for new Oilers to require several watches to leam how to correctly take a set of readings, 
and the feedback that the Engineer provides them is required in order for them to complete this 
learning process. 

At least once per four-hour watch, the Engineer records a set of readings representing the most 
important plant parameters logged on the Oiler watch round form into the vessel’s official log 
book. The official log book is a large-format book that is custom designed and printed for the 
vessel and provides space to record the readings in tabular fonn. The log book pages also 
include spaces for each watch stander to record notable events, such as the starting or stopping of 
equipment, the addition of lube or fuel oil to any machinery, or any arrivals or departures. These 
pages also include space for each watch engineer to print and sign their name, attesting to the 
accuracy of everything that is recorded during their watch. An example of a typical engine room 
log book is shown in Figure 9 and Figure 10. 

On an ocean-going vessel with a conventional watch rotation and a Chief Engineer, the official 
log book is presented to the Chief Engineer on a daily basis for review. Every log book page 
includes a signature line for the Chief Engineer, who reviews all readings recorded for the 24- 
hour period of operation and signs the log to attest that the readings are correct. If the Chief 
Engineer identifies any issues with the readings or the log book, they would discuss the issue 
with the appropriate watch stander prior to signing. 
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Figure 9 Excerpt of a typical engine room log book - Page 1 (courtesy California State Maritime Academy) 
The above description of typical or sample watch processes is not suggested as a prescription for 
the SSA, but rather as an example of a well-developed watch process that forces crew members 
to pay attention to critical parameters, and thereby ensures that they will recognize when 
equipment is running outside of normal process ranges. For example: 

• When the watch Engineer is forced to record plant parameters into an official log book 
and then sign for the accuracy of the recorded readings, they will take more care to 
ensure the readings are correct and properly entered into the log book. 

• When the watch Engineer is motivated to record the correct readings into the official log 
book, they will ensure that the watch Oiler is correctly logging plant readings on their 
watch round forms. 

• If the watch Engineer is made accountable for the performance of the watch Oiler, and in 
particular their accurate recording of plant parameters on the watch round sheets, they 
will be more inclined to ensure that their watch partner is well informed about the plant. 

• The transcription of process variables in a table that logs plant variables at regular time 
intervals illuminates whether the variable has changed over the past several watches. 

This makes unusual trends very obvious to the watch stander. The repeated transcription 
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of these values over a period of watches has the natural effect of helping the crew 
members internalize the ‘normal’ values for all plant parameters. 

• The logging of plant variables into an official log book and the retention of watch Oiler 
round sheets creates official records of plant readings and watch activities, which can be 
reviewed and audited by a senior watch stander or engineering supervisors. Such review 
provides feedback to those responsible for crew training and vessel operations regarding 
the performance of watch standers. 
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Figure 10 Excerpt of a typical engine room log book - Page 2 (courtesy California State Maritime Academy) 

4.3.2.3 Specific Solutions 

The SSA can decrease the chances that abnormal plant conditions, such as those associated with 
the M/V Martha’s Vineyard March 17 th and May 5 th blackouts, will go unrecognized in the 
future by instituting new watch standards and processes such as those described in this section. 

A solution to this is for the SSA to develop new engine room watch processes, document them as 
formal policies and procedures, and implement them by putting the required tools in place and 
training crews on how the tools are to be used. The new watch processes should incorporate the 
following features and characteristics: 
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• An individual within the SSA management is responsible for the perfonnance of all 
engine room watch standers, and this ‘Watch Supervisor’ is empowered with 
sufficient authority and resources to develop and maintain watch policies/procedures 
and ensure that all crew are adequately trained. The watch supervisor is held 
accountable for any issues with crew performance. 

• Watch Engineers are responsible for the safe operation of the vessel during their 
watch, for the accurate completion of the official engine room log book, and for the 
performance of the watch Oiler. 

• There are well developed expectations about how crew members stand their watches, 
which are clearly communicated to all watch standers through documented policies, 
procedures, and standing orders. 

• Watch Oilers complete watch round reading forms that have been developed by the 
SSA and are specific to each vessel. These watch round forms are retained onboard 
and reviewed by the senior watch stander and the member of the SSA management 
who is responsible for watch stander performance. 

• Entries are made into an official log book, which has been developed by the SSA and 
is specific to each vessel, once per four-hour watch by the watch Engineer. The 
watch Engineer signs the log book on a per watch (or per shift) basis, attesting to the 
fact that the log book is a complete and accurate representation of the vessel’s 
operation. 

• The watch supervisor periodically reviews Oiler watch round forms and the official 
engine room log books, to ensure that all readings are correct and to identify any 
unusual or unexpected trends in the data. 

4.3.3 Watch System 

Provisions for “alternative compliance” regarding work/rest periods are outlined on each vessel’s 
Certificate of Inspection (COI) issued by the USCG. These provisions allow the SSA crews to 
work for periods up to 18 hours and with little rest between watches. Although approved by the 
cognizant Officer in Charge of Marine Inspections (OCMI), these are among the only provisions 
of this type our collective team has witnessed in the domestic ferry industry. 

Sailing schedules are tightly integrated with crew schedules and may require complex union 
negotiations to make any adjustments. For example, it is widely understood that scheduled 15- 
minute vessel turnarounds are insufficient resulting in (unpublished) late departures. However, 
these short turnarounds were established to help ensure vessel crews comply with the work/rest 
requirements stated in provisions for alternative compliance. 

Work rules agreed to by crew members through union negotiations contractually provide for 
only one alternative crew schedule. It has been reported that this alternative was a compromise 
that remains unpopular among many crew members and is collectively referred to as “the nuclear 
option.” 

4.3.3.1 Issue 

Regardless of the route of the vessel or work rules agreed to by crewmembers individually or 
through collective bargaining, persons who are assigned duties as officer in charge of a watch or 
whose duties involve safety, pollution prevention, and security are required to be fit for duty. If 
credentialed officers or crew members are too fatigued to stand an alert watch, a hazardous 
condition has been created. 
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Instances regarding excessive workloads, automation system failures, management system 
failures, inability to safely operate and maintain the vessel, and design- or component-related 
issues increase the likelihood of a serious marine incident. 

4.3.3.2 Industry Standards/Best Practices 

A 12-hour work day is considered a reasonable work hour limit for vessels of this class. 

Although the 2010 amendments to the STCW Convention that include changes to the hours of 
rest requirements are only applicable to personnel working on board U.S. vessels subject to 
STCW, the typical work hour limits for vessels of this type are no more than 12 hours in a 24- 
hour period. 

Regardless of regulatory restrictions and the interpretation of how those are applied, the 
international and domestic regulations clearly indicate the importance of combating fatigue in 
vessel crews and ensuring it does not become a contributing factor to incidents. The industry has 
embraced a strict adherence to the 12-hour rule primarily due to the acknowledgement and 
understanding that crews are frequently faced with extenuating circumstances which require their 
rest periods to be impacted. While the 12-hour rule ensures some flexibility regarding these 
circumstances, the current schedule being utilized at the SSA does not allow for any margin of 
error. 

4.3.3.3 Specific Solutions 

The SSA should develop a fatigue risk management plan to assess, inform, and continuously 
improve fatigue risk management. In developing a fatigue risk management plan, the SSA 
should carefully consider the circumstances and intent of the alternative provisions regarding 
work/rest periods outlined on each vessel’s COI and consider the principles in establishing work 
hour limits for mariners. In addition, the SSA should take the following steps: 

• Ensure employees and management are educated regarding safety concerns of inadequate 
rest. 

• Utilize the model format for records of hours of work or hours of rest of seafarers 
developed by the IMO (Reference 9). 

4.3.4 Standard Operating Procedures 

There are three areas where the SSA’s current procedure documentation could be improved: 

Integration. On-site field observations and an examination of the provided documentation 
indicated that the program and procedural interfaces between the Vessel Systems and Training 
Manual, the Vessel Operations and Safety Manual and other operations manuals such as the 
Customer Handbook, the Pilot Training Manual and the I ISC Craft Operations Manual (specific 
to the Iyanough) are not clearly defined. 

There were also numerous accounts of policy updates distributed by memorandum that were not 
tracked and/or documented. Observations identified memos to be the primary mechanism for 
communicating policies and procedures. Typically, the memo was the procedure. 

Obsolescence. A document review and interviews with crew members across the fleet indicated 
that the Vessel Operations and Safety Manual (est. 1997) includes procedures that are not being 
consistently utilized or applied. In some cases, procedures were in conflict with subsequent 
memos without any corrections or updates being made to acknowledge or establish precedence. 
The majority of crew were unaware of the manual’s existence. 
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Risk assessment. A document review indicated that the SSA operating procedures do not 
include risk assessments or job hazard analyses. 

4.3.4.1 Issues 

Integration. There are many partially-developed management systems at work at the SSA. Users 
of these systems find it difficult to detennine which system or manual to reference for any 
particular requirement, which can confuse roles and responsibilities regarding operating 
procedures and safety management. 

Under the current system, when a new procedure is published or changes to existing procedures 
are adopted it is unclear how to incorporate them. Properly integrating and summarizing each 
management system by conveying the system’s basic design concept aids employees without 
specialized skills in navigating program and procedural interfaces. 

Memos are not integrated into a comprehensive safety system and subject the user to a data 
mining process that is unlikely to be followed. There is no means to help ensure that all affected 
users are aware of changes or additions distributed by memo. There is no means to alleviate or 
identify conflicts with previous policies or procedures. 

Obsolescence. The SSA’s Vessel Operations and Safety Manual (est. 1997) was crafted in an 
apparent attempt to meet or emulate ISM Code requirements at the time of its implementation 
(1998 for passenger vessels). Although the ISM Code is internationally accepted as the standard 
for the safe operation of ships and pollution prevention, the SSA is not using it. 

Risk assessment. Safety management objectives should establish safeguards against all 
identified risks. Although the method of identifying risks may vary, the approach should be well 
organized and planned. 

4.3.4.2 Industry Standards/Best Practices 

As the maritime industry has adopted management systems as an effective way to establish, 
communicate, and verily compliance with policies and procedures, it has not been without 
difficulties. With the more active management of vessels comes the burden of ensuring crews 
are not overburdened by, confused by, or unaware of new procedures. Over the past twenty 
years, operators have adapted by ensuring management systems follow strict document control 
and communications protocols. The systems are also designed and managed to ensure proper 
integration of their various elements. 

4.3.4.3 Specific Solutions 

Integration / Obsolescence. Provide a clear demarcation of management system interfaces so 
personnel have no confusion regarding their roles and responsibilities regarding operating 
procedures and safety management. 

• Designate a person responsible for ensuring all document control procedures are 
followed. 

• Develop a list of all SSA management systems. 

• Develop a process to track documentation updates, revisions, and additions to ensure 
accuracy and consistency. Include an explanation of document revision and distribution 
routines. Ensure procedural changes are rigorously tracked, organized and easily 
accessible by vessel personnel. 

• Establish a means to explain and discuss procedural changes with vessel personnel. 

• Ensure only current copies of procedures are being used. Destroy older versions. 
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Risk assessment. The SSA should specify a methodology adopted for performing risk 
assessments and show evidence they have addressed a given risk for each procedure. At a 
minimum each procedure should include the following: 

• Activity being performed. 

• Known hazards. 

• Possible consequences. 

• Measures to reduce or eliminate risk (risk control). 

4.3.5 Emergency Response Plans 

It was observed that the SSA does not have a consolidated reference containing procedures for 
responding to emergencies on board the vessels or at the terminals. This includes a lack of plans 
for management response, including coordination of repair activities, public communications, 
and scheduling contingencies. 

Incidents and emergency situations are responded to with an infonnal, ad hoc approach. The 
SSA relies heavily on institutional knowledge of staff to direct their response (see Section 4.1.8 
for a detailed discussion on SSA’s over-reliance on institutional knowledge). 

4.3.5.1 Issue 

Ferries systems are extremely complex, and even the best organizations cannot eliminate 
incidents completely. Minor mechanical issues can cause delays or other inconveniences, and 
major incidents such as groundings, collisions, or fires can have long-term impacts on 
operations, pose financial and reputational risks, and threaten the safety of passengers and crew. 
While prevention is a key to mitigating these risks, it is also critical to have adequate plans in 
place to minimize their impact if they do happen. 

Organizations without a clear and consolidated emergency response plan are generally 
ineffective at responding to situations they have not previously experienced. New hires in such 
organizations are at a severe disadvantage, relying solely on instinct to aid the response efforts. 

4.3.5.2 Industry Standards/Best Practices 

Most maritime operations develop, implement, and periodically train with an emergency 
response plan. This is a requirement of any operation subject to the International Safety 
Management (ISM) Code but is also viewed as an industry best practice by most operators. 

Many operators also invest in specialized training for vessel crews and management. Most 
vessel officers and other crew should have fonnal training in firefighting, basic safety, survival at 
sea, and emergency medical and first aid. Passenger vessel operators should also invest in crowd 
and crisis management. At the management level, many operators ensure key personnel receive 
formalized training in emergency procedures management and the Incident Command System 
(ICS). 

4.3.5.3 Specific Solutions 

The SSA should develop an emergency response plan that provides guidelines to vessel crews on 
response. Plan development should include the following steps: 

• Establish a list of existing emergency procedures. Identify missing or incomplete 
elements and publish a standard procedure for each. 

• In addition to emergency response, ensure the plan provides guidelines to vessel crews on 
communications protocols. 
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• Ensure the system addresses the following items, at a minimum: 

• Fire Fighting • Loss of steering 

• Flooding • Loss of propulsion 

• Abandon Ship • Emergency towing 

• MOB • Emergency anchoring 

• Heavy weather • Grounding 

• Hazardous bars • Collision 

• Medical Emergency • Pollution 

• SAR (Search and Rescue) • Icing conditions 

• Piracy / Terrorism • Shifting Cargo (vehicles) 

• Emergency Assistance to 
Other Vessels 

• Incorporate additional training on response topics specific to SSA, as well as annual 
tabletop exercises to include all five major functional areas of a standard ICS; Command, 
Operations, Planning, Logistics, and Finance/Administrations. Within these should be 
subcategories that focus on safety and public communications/media. 

4.3.6 Sailing Schedule 

Discussions with the SSA personnel and an examination of the provided documentation revealed 
that no contingency plan for unplanned trip cancellations exists. This results in fleet rotation 
challenges when the system is utilized at near-full capacity. 

Sailing schedules and crew schedules are interdependent and may require complex union 
negotiations in order to adjust. For example, it is widely understood that scheduled 15-minute 
vessel turnarounds are insufficient, resulting in (unpublished) late departures. However, these 
short turnarounds were established to help ensure vessel crews comply with the work/rest 
requirements stated in provisions for alternative compliance on the vessel Certificates of 
Inspection (see Section 4.3.3 Watch System). 

4.3.6.1 Issues 

System reliability and system capacity are inversely related. When ferry system capacity is 
reduced (e.g. a vessel breaks down resulting in a cancelled trip) without a commensurate 
reduction in trips on the ferry schedule, system reliability is diminished. Alternatively, when 
system capacity is increased (a vessel is added) without adding trips to the ferry schedule, 
reliability increases; there is an increased likelihood that the ferry system will perfonn to fulfill 
its purpose and meet public expectations. 

Currently, when unplanned trip cancellations occur, the likelihood that the SSA ferry system will 
perform to meet its purpose is very low. The SSA’s response to numerous ferry cancellations in 
the spring of 2018 resulted in decreased system reliability and a loss of public confidence. This 
strongly indicates that the ferry system is overburdened during the busy summer months. 

It is important to note in this section that the term “ferry system” refers to “system” or “line” 
capacity when the entire feet is deployed. In operations vernacular it may be referred to as 
“rolling stock capacity” but should not be confused with seating capacity, vehicle capacity, or 
design capacity. 

Since the likelihood of adding a standby ferry vessel is low due to the extraordinary expense, the 
most feasible solution is to have contingency plans in place detailing how to respond to 
unplanned trip cancellations. Currently there is no formal contingency plan. 
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4.3.6.2 Industry Standards/Best Practices 

Although practices may vary among operator’s fleet rotations and vessel assignments that satisfy 
some variety of unusual circumstances regarding unplanned trip cancellations are commonly 
outlined in a single document such as a contingency plan. Although the final solution for any 
given trip cancellation and how to manage it may vary, a contingency plan document can be used 
as a valuable decision-making tool. 

4.3.6.3 Specific Solutions 

The SSA currently utilizes an informal, case-by-case approach to dealing with trip cancellations. 
This approach may be successful at times but breaks down under increasingly complex 
conditions. No model is perfect, but memorializing the successes, failures, and lessons learned 
from the SSA’s past experience with unplanned trip cancellation will help identify and mitigate 
operational and capacity risks of future cancellations. 

The SSA can begin implementation of this solution by articulating in writing the goals they wish 
to achieve when a trip is cancelled. They can then develop a contingency plan to achieve these 
goals that includes same-day service adjustments. Contingency plan development should include 
the following tasks: 

• Specify vessel assignments by outlining which vessels are assigned to each route under 
nonnal conditions. 

• Identify possible solutions in the event of an unplanned cancellations for each route that 
includes vessel rotations and messaging the public (reduce the number sailings, lease a 
vessel, etc.) 

• Define the constraints for each solution. 

• Outline schedule recovery opportunities. 

• Consider these constraints when publishing future schedules. 

4.3.7 Weather Cancellations 

There was some speculation by members of the SSA that one reason for the increased number of 
trip cancellations and delays may have been due to a reduction over time in the willingness of 
captains to operate the SSA’s ferries in the same inclement weather conditions in which they 
once would have operated. This opinion was found to be held by a small minority of employees. 

There was unanimous consensus among management that captains have full responsibility and 
authority in their detennination of whether to sail, and should not be pressured into getting 
underway. There was nearly unanimous consensus among captains that management respected 
their judgment on whether or not it was safe to sail. No evidence of undue pressure on captains 
to sail was observed. 

Three factors were observed that may affect the detennination made by captains to sail in 
inclement weather conditions: 

1. There has been a reduction in the average required minimum skill level of deckhands, 
due to the replacement of some Able Seamen (ABs) with Ordinary Seamen (OSs). 

2. There has been a reduction in the average skill of entry-level employees due to an aging 
workforce and difficulty filling deckhand roles. 

3. There are frequent crew rotations and deficient training, resulting in crews being, on 
average, less familiar with the vessels on which they operate than if they were assigned 
longer tenures to each vessel, and formally trained on the operation of each vessel onto 
which they were rotated. 


Comprehensive Review of the Steamship Authority’s Operations 


91 


13 December 2018 




The captain must decide whether or not it is safe to sail in inclement weather conditions based on 
many variables beyond wind speed and sea state. The decision must consider these variables 
along the entire route, not just the known conditions at the dock. Examples of these variables 
include: 

• The ability of crew to operate the vessel and respond to emergencies at any time. 

• The condition and state of machinery. 

• Seaworthiness of the vessel. 

• Number and demographics of passengers being carried. 

• Type and disposition of cargo being carried. 

• Density and types of vessel traffic in navigation channels. 

• Vessel maneuvering and seakeeping characteristics. 

• Restrictions or hazards to navigation. 

• Speed of advance. 

• Other environmental variables, including: 

o Visibility (due to time of day, fog, precipitation), 
o Wind direction (certain wind directions are worse than others), 
o Tidal current direction and force (particularly in relation to wind direction and 
force). 

o Temperature (which could affect icing of decks, visibility, consequences if there 
is a man overboard, etc.) 


4.3.7.1 Issues 

Under general maritime law, the master is ultimately responsible for the safety of the vessel’s 
crew, passengers, and cargo. It is generally recognized that the master has the overriding 
authority to control the vessel, including whether or not to get underway. 

The decision to sail or not, under inclement weather conditions and any other variables 
concerning safety, is not one that can be reliably quantified. There are too many variables, many 
of which are elusive and extremely dynamic in nature. 

Although increased cancellations reduce vessel revenue and reliability, questioning or attempting 
to influence the master’s decisions will only result in a further erosion of trust between vessel 
crew and management. Ultimately this will only increase the rate of missed sailings. 


4.3.7.2 Industry Standards/Best Practices 

The chain of command is critical on a ferry, because an ever-changing environment must be 
reacted to immediately to avoid incidents. This requires one person (the captain or master) to 
have the final and ultimate say on all operating decisions. Consequently, the captain is 
ultimately responsible for the safety of all of the occupants of the ferry and the surrounding 
environment. Therefore, it should be the captain’s decision on whether to sail in inclement 
weather conditions, based on a consideration of all the factors that affect safety. 

Ferry systems with well-trained crew, seaworthy ferries, and reliable equipment tend to have 
more reliable service in inclement weather conditions. 


4.3.7.3 Specific Solutions 

Management should focus on factors it can control. If the SSA can improve the skill and training 
of its employees, perhaps it will be able to realize a reduction in trip cancellations and delays. 
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To increase the probability that a captain will operate in marginal weather conditions, the SSA 
should focus on improving the skill of its employees and the quality of its equipment. Crew re¬ 
training should be formalized as described in Section 4.3.1. 

The SSA should also reevaluate the costs and benefits of replacing ABs with OSs. Although the 
reduction in skill level may result in some cost savings, it could also contribute to an increase in 
weather cancellations, reducing revenue, or to other incidents that increase costs and reduce 
revenue. 

Vessel reliability should also be improved by implementing a quality management system that 
systematically locates and resolves quality issues, continually improving the safety and reliability 
of the vessels. Beyond the direct effect on reducing unplanned maintenance, the vessel crews 
will grow more confident in the reliability of their vessels over time, which will translate into 
more confidence to operate in marginal weather conditions. 

4.3.8 Operational Metrics 

The program for collecting and interpreting performance metrics was observed to be incomplete 
and lacking specificity. For example, trip cancellation reports provide only three reasons for 
cancellation: Weather, Mechanical, or Other, without the ability to provide further details. 

4.3.8.1 Issues 

One issue is that the desire for users of the SSA ferries to hold the organization accountable for 
its operation reflects an interest in transparency and a results-oriented means of conducting 
business. Without accurately defining key performance metrics the level of service and 
performance cannot be measured and it is therefore difficult to make improvements. 

Another issue is that metrics tend to over-simplify more complex attributes which can create 
problems if the metric is not well defined or understood . For example, the trip cancellation 
report lists only three reasons for a cancelled trip (weather, mechanical or other). These 
categories do not address the multitude of variables involved in each case, the results will be 
misleading and hamper the organization’s ability to identify real performance issues and address 
them. 

Another example exists regarding trip cancellations due to bad weather. The lack of qualifying 
factors could lead management to wonder why there have been more cancellations. Perhaps 
management may draw inaccurate conclusions based on this limited data. Armed with only a 
numerical value (without context) an implied message is that the vessel crew may have done 
something wrong that could result in pressure on the captain to neglect the broader goals of the 
organization by questioning his or her own judgement. 

Dedicating time to carefully articulate the intent of each metric can help guide the process of 
improvement. For example, if a ferry service is measuring reliability as a metric, a simple 
statement excluding “force majeure” events may help distinguish its purpose. 

4.3.8.2 Industry Standards/Best Practices: 

All ferry systems are unique and are therefore best served by developing their own performance 
metrics tailored to their system. 

The stakeholders tend to have the best sense of which operational perfonnance metrics are best 
suited to their organization. However, some metrics are more common than others for ferry 
services like the SSA. Among those are reliability, on time departures and missed sailings. 

Safety metrics such as lost-time accidents and near-misses are also very common. For example, 
Washington State Ferries metrics include on-time perfonnance, service reliability, total vessel 
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out-of-service time and passenger satisfaction. A smaller operator, Pierce County Ferry tracks 
and publishes perfonnance metrics which include total ridership, vehicles left behind and on- 
time/delay metrics. 

4.3.8.3 Specific Solutions: 

Establish operational KPIs for the fleet using the standard format in the examples provided 
below. 

• Determine how the SSA views success on an operational basis and identify key 
performance indicators (KPIs) that should be used (see Section 4.1.2 Strategic Planning). 

• Clearly define each metric and establish how it will be collected and reported. 

• Define the desired targets. 

• Hold key managers accountable to meeting these targets by requiring them to develop 
performance plans and incorporating the goals into performance reviews. 

• At a minimum, adopt the following operational KPIs: 

Metric: Reliability 

Data Source: Ships logbook or short form 

Frequency: Per sailing (continuously from crew) 

Target: 99% sailing completion 

In this metric, reliability is defined as the proportion of completed trips to scheduled trips. A 99% goal 
for reliability should exclude ‘force majeure’ events outside of human control such as weather 
conditions and include planned maintenance events (yard periods) and mechanical failures. 

Establishing a desired reliability of 100% suggests that the operator has a reliable backup vessel plan, 
robust preventative maintenance programs and can effectively respond to operational needs. Trip 
cancellations should be recorded in the ships logbook and continuously monitored against the schedule. 


Metric: On Time Departure 

Data Source: Ships logbook 

Frequency: Per occurrence (continuously from crew) 

Target: Three minutes at 95% 

Considering the duration of this route, HMS recommends vessel departures no later than 5 minutes 
95% of the time (in normal operating conditions) as reported in the ship’s logbook by the vessel’s 
Master. Measuring on time departures provides insight to operational needs. For example, was a delay 
the result of a slow boarding process or a mechanical failure? Did ice on the boarding ramp delay the 
loading process? Delays should be continuously monitored and reported at regular intervals. 


Metric: Missed Sailings 

Data Source: Ships logbook 

Frequency: Per occurrence (continuously from crew) 

Target: 0 

Missed sailings metrics vary from reliability metrics in in that they measure the results of unplanned 
disruptions of service. They should be reported as a critical item using a Situation Report (SITREP) 
and evaluated on a case by case basis. Missed sailings are often the result of mechanical failures but 
may also include incidents or accumulated delays and it is critical to analyze all of the variable 
associated with each missed sailing. 
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4.3.9 Terminal Flow 

Inefficiencies in the loading and offloading process were observed, especially with regards to 
lane use control, signage directing passengers to appropriate platforms and real time messaging 
to the public of arrival/departure information and updates. 

The SSA terminal system appears to rely heavily on personal interaction to convey information, 
at which the employees were observed to be particularly adept. From standard queuing 
instructions to answering questions regarding delays and cancellations, the on-site terminal 
employees are the default method of communication. 

4.3.9.1 Issue 

Inefficiencies in tenninal flow are detrimental to service levels and passenger wait times, 
especially when trip cancellations occur. This has a cascading effect on passenger satisfaction 
and employee morale, particularly when confused passengers randomly inquire with passing 
SSA employees. Communicating information in this way makes it difficult to control the 
message or maintain consistency. 

The SSA ferries are subject to delays caused by backing vehicles, turning vehicles, pedestrian 
crossings, and high traffic volumes at various tenninals. The proximity of tenninal components 
and the number of vehicles and passengers each component must process is negatively impacting 
tenninal flow. 

Opportunities to message the public in real time regarding arrival and departure information 
updates are being missed, especially when trips are cancelled or delayed. Messaging the public 
about arrival and departure information, including trip delays and cancellations in real time, 
using different modes of communication (signs, smartphone messaging, radio announcements), 
would relieve congestion and ease terminal flow when unplanned trip cancellations occur. 

4.3.9.2 Industry Standards/Best Practices 

Much can be learned from other modes of public transportation such as bus lines, airport 
tenninals and train stations. Peers in the marine industry utilize highly visible numbered lanes for 
staging vehicles and clear demarcation lines for exclusive right of ways for both passengers and 
vehicles. This is done for efficiency and the safety of passengers and employees. Strategically- 
placed monitors and digital signage providing real time updates regarding arrivals, departures 
and cancellations are utilized throughout the transportation industry. 

4.3.9.3 Specific Solutions 

Perform a passenger flow analysis addressing the following items: 

• The current behavior of passenger and vehicle flow. 

• A model of potential choke points. 

• Lane use control. 

• Vehicle and passenger right of ways. 

• Traffic controls (signals / stop signs). 

• Boarding and loading ramp capacities. 

• Potential improvements. 

Install signs, monitors and digital signage to message the public in real time. 
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• Install a real time sign on the roadside in the vicinity of the operations center in Falmouth 
reporting cancellations and delays to drivers bound for the ferry approximately six miles 
away. 

• Install monitors with real time schedule updates and cancellation notices in highly visible 
locations. 

Establish an advisory radio broadcast system. 

• For each port apply for an AM radio broadcast station license through the FCC on 
allocated non-interference frequencies between 540 kHz and 1700 KHz and establish an 
advisory radio station providing real time schedule updates to the public. Updated 
messages can be recorded and broadcast as needed. 

Post highway signs on approach to each terminal indicating the presence of the system and 
instructions regarding how to access the system. For example, “Tune your radio 550 AM for up 
to date ferry schedules and service adjustments.” 

Install highly visible numbered lanes for vehicles. 

• Install highly visible numbered lanes for vehicles at each terminal. 

• Install highly visible directional signage. 

4.4 IT Systems 

4.4.1 IT Project Planning 

On site field observations and interviews with IT staff revealed a lack of planning for IT 
activities. Although active projects are being updated at weekly management meetings, an IT- 
specific strategic master plan (such as a five-year plan) or an inventory of the top five IT projects 
for 2018 could not be produced upon request. 

Further inquiries and interviews with IT staff revealed that there is no centralized means to track 
and prioritize known issues related to the SSA’s IT systems. The SSA’s IT systems are mission 
critical and include the: 

• Reservation system. 

• Point of sale (pos) system. 

• Website. 

• Network/servers. 

• Phone system. 

• Email marketing system. 

4.4.1.1 Issues 

Without a proper plan or strategy, the SSA may have trouble keeping technology projects within 
scope, schedule, and budget, and other departments will not know when to expect the 
efficiencies required to drive the future of their respective departments (i.e. mobile app-based 
ticketing POS for all ferries and ports). This has a direct impact on the entire organization’s 
ability to effectively plan, and to maintain adequate staffing and resources to accomplish goals 
and projects within the timeframe allowed. 

All developers and contractors that are based on hourly fees need to be organized and complete 
projects on time with the appropriate speed and urgency. Currently, developers and contractors 
are allowed too much flexibility if there is no plan identifying project parameters. 
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The absence of a centralized means to track and prioritize known IT issues does not allow 
management to prioritize those items that are “urgent for the business” versus “nice to have for 
the public.” 

4.4.1.2 Industry Standards/Best Practices 

Although the complexity of the any given project plan may vary, a basic work breakdown 
structure outlining infonnation such as scope, schedule, and budget is a hallmark of IT best 
practices. 

The normal industry best practice to track and prioritize IT issues is to establish an IT help desk. 
As problems are initially evaluated by the IT help desk, they are assigned a priority and severity 
level. If issues cannot be handled by the help desk, they are assigned and tracked to other staff 
whose specific job function it is to handle those issues. The help desk would also serve the 
customers for IT-related issues, such as problems with the phone APP or at a ticket tenninal, 
wi-fi, etc. These issues would be treated much the same way as IT staff issues, either handled 
directly and expeditiously or assigned to someone who can better assist. 

4.4.1.3 Specific Solutions 

• Establish top five priorities for 2019, Each mission critical system should be managed 
through a list of “Development” items (scope, budget, timeline, and project leader). 

o Establish a “Development List” prior to the start of the fiscal year that provides 
stakeholders insight into the What is happening in the IT Department, When it is 
being deployed, How Much it costs to implement and Who will lead the project. 

o Prioritize the “Development List” to determine the SSA’s top five IT priorities for 
2019. 

• Draft an IT-specific strategic plan (five years). With a focus on solutions that facilitate 
process improvement, establish a master plan for the department that lays out its strategic 
direction and operational priorities. Outline initiatives (computer replacement, server 
consolidation, cloud-based computing, stewardship of the reservation system) that reflect 
these priorities. 

• Establish an IT help desk to track and prioritize IT issues. Each mission critical 
system should be managed through a centralized means to track and prioritize known IT 
issues that includes the following capabilities: 

o Ticket creation, 
o Routing and prioritization, 
o Notification and escalation. 

o Routine (monthly) testing procedures for each system. 

4.4.2 Reservation System 

Discussions and interviews with the SSA IT staff revealed that the SSA’s reservation system is 
entirely owned, managed, and maintained by a single individual operating remotely and the 
report program generator (RPG) code that the system is written in is dangerously outdated. The 
SSA’s departmental constituents do not have access to the code or know how it works, resulting 
in a “single point of failure” should this proprietor of the reservation software become 
incapacitated or otherwise unavailable. 
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4.4.2.1 


Issue 


The primary issue is that if the current owner of the reservation system’s source code becomes 
disgruntled or deceased, or if the company becomes insolvent or is sold, the SSA could be 
rendered operationally ineffective if they do not have the ability to access and maintain the 
source code. 

In the event that a contractual solution was established, it is important to note that the RPG code 
is a very old programing language that is dangerously outdated. This programing language is not 
used in any form of modern development and the likelihood of finding a coder that could 
develop or fix an issue in the event of an emergency is very low. 

4.4.2.2 Industry Standards/Best Practices 

Best practices may vary according to the organization but, under normal conditions, an 
appropriate standard would be to maintain some level of proprietary or contractual control over 
any system that is essential to the function of the organization. 

Most companies have either built their reservation system so they control it or they have bought 
a system that they then have full access to develop. Other organizations that use licensed systems 
and do not grant access to the code, provide contractual obligations in regards to uptime / 
development and bug fixes, they also host and maintain the servers and infrastructure to ensure 
these deliverables. 

4.4.2.3 Specific Solutions 

The SSA and the reservation company have discussed possible solutions including: 

• Buying the company/code, including owner, and having the owner teach and train 
existing employees and new employees to develop the system. 

• Moving away from the existing reservation platform to a new web-based system. 
Reportedly, the challenge with this option has been the uniqueness of the “truck/car 
spatial organization” feature of the existing reservation system (i.e. how many 
trucks/cars can fit on a given vessel). 

To choose from the identified solutions, the SSA should perform a cost/benefit analysis of the 
following two options: 

• Purchasing the reservation code outright and hire RPG programmers that start to 
immediately train on and develop the source code of the existing reservation system, 
or 

• Examine off the shelf solutions like www.carus.com and develop an RFQ for a new 
modem cloud-based reservation platfonn that is mobile-compliant, PCI-compliant, 
and seamlessly integrates with the online web portal. Systems like this often offer 
custom modules that can solve the “truck/car spatial organization” issue. 

4.4.3 Website Platform Management 

Although the SSA’s website uses a custom CMS (content management system) not all essential 
personnel have access or training and it is unclear who has been designated the content manager. 
Under the current system, the website platform is managed by multiple teams in multiple 
departments. If it is “managed by everyone” then it is really “managed by no one”. 

For example, the marketing department updates some of the content (pictures, text), the 
operations department updates schedules and prices whilst the IT department/ 3 rd party developer 
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updates functionality, maintain servers and back-ups, develops integrations to other systems and 
maintains the “up-time”. 

Interviews with representatives from iMarc, the current 3 rd party web developer, revealed that the 
relationship between SSA and iMarc is not well defined. The website is hosted at SSA with little 
to no access by developer. The developer does not track the status of website problems but 
attends to them in an “ad hoc” fashion, only as requested by SSA. 

Further interviews with staff suggest that no single person is focused on SEO (search engine 
optimization) or Google Analytics (tool used to detennine simple traffic stats, user and usage 
stats, referring sources, top pages, etc. for mostly marketing knowledge). Google analytics script 
is installed but no dashboard or reporting or regular usage and viewing of the statistics is being 
done. 

4.4.3.1 Issue 

The issue with an incomplete content management system is that there are multiple contributors. 
If the rules of collaboration are not well defined the resulting digital content can easily become 
mis aligned with the goals of the organization and incorrect or inappropriate infonnation can be 
uploaded. Ambiguity regarding the responsibilities of the web developer, the IT department and 
other department should be avoided. 

The issue with an ill-defined/ad hoc relationship with the web developer (iMarc) is that the 
developer remains unaware of the changing priorities at SSA. There is no path or clearly defined 
deliverables which reflects poor management principles. This is an iteration of the IT project 
planning observation in that improper planning serves as a barrier for projects relating to the 
website to stay on track and under budget. 

The issue with a lack of SEO utilization is that, under current conditions, competing ferry 
services are displayed over SSA’s. As the leading public service to Nantucket and Martha’s 
Vineyard the SSA should be the number one result. Compare search results for a user searching 
for a “Boston Bus” and a search engine will first show the MBTA (Massachusetts Bay Transit 
Authority). This should be the case for the SSA. 

4.4.3.2 Industry Standards/Best Practices 

Normally a company would designate members of the department to serve as the website’s 
content manager, a liaison to the web developer and/or the person responsible for Search Engine 
Optimization. The duties and responsibilities for each role would be clearly defined and 
delegated to staff. 

4.4.3.3 Specific Solutions 

Establish a website content manager. The IT department should clearly establish its role 
regarding the website. Although the IT department must coordinate marketing and operations 
ultimately, IT must serve as the gatekeeper to this relationship. This gatekeeper role should be 
clearly defined and agreed upon throughout the organization. 

The content manager should manage website specific project lists and provide the tools (CMS) 
and ensure only designated and trained employees in marketing and other departments have 
access to the system (authority to upload content should be strictly enforced) and updates to the 
website should be approved before any changes are made. 

Regular communication with iMarc. Establish bi-weekly update meetings with iMarc to stay 
informed of current projects and review all deliverables. Establish a monthly / quarterly project 
development plan with measured deliverables and responsible parties. A project manager should 
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be responsible for all deliverables and deadlines and keeping the SSA and iMarc team members 
in coordination. All projects should be tracked using a project-based software to allow for 
transparency at anytime to the SSA employee’s / council / iMarc management. 

Develop an SEO (Search Engine Optimization) strategy. Establish a “.gov” domain and 
establish an SEO strategy that reflects the priorities of SSA ridership. SSA should maintain their 
presence in SEO and through their web address as a .gov as the government provided and 
maintained ferry system to the island and distinguish themselves from the privately held but 
licensed ferry providers. 
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Section 5 Final Recommendations and 

Implementation Plans 

The analysis of SSA’s operations identified numerous areas of potential improvement. The 
following section details the opportunities for improvement that were deemed to be both 
achievable and impactful. 

Where these opportunities for improvement were deemed to be both achievable and impactful, 
they were included in our final recommendations, which are detailed in this section. The final 
recommendations aligned with four key categories: 

1. Implement Process-based Management 

2. Establish a Vision 

3. Change Organizational Structure 

4. Change Management Recruitment and Performance Evaluation 

The study team felt these categories were significant, and introduce each as a concept in this 
section, supported by the specific recommendations that will advance them. 

These final recommendations encapsulate the specific solutions the study team believes will 
provide the best combinations of impact and ease of implementation. Some can have a 
meaningful impact with minimal effort. Some will have significant impact but will require more 
resources to implement, while others are in between, offering moderate impact and moderate 
ease of implementation. 

A key point which requires emphasis is that all of the following recommendations must be 
properly funded and assigned the necessary resources in order to be successful. Whether the 
SSA feels they have both the expertise and resources in-house or will need to engage external 
resources, all items will require proper funding and commitment from leadership. 

Each recommendation is accompanied by a preliminary Implementation Plan intended to provide 
high-level guidance to SSA leadership by infonning them of the general strategy, any 
prerequisite steps which must take place, and any major challenges the study team anticipates the 
SSA may face. Each implementation plan identifies the scope, schedule and cost estimates (not 
including in-house resources) based on stated assumptions. These are rough order of magnitude 
estimates aimed at providing relative guidance and can be influenced greatly by the 
implementation strategy the SSA elects to pursue for each recommendation. 

The plans are defined by three distinct phases: Development, Implementation and Maintenance. 
Development represents the effort to design and create the system. Implementation is focused on 
introducing the system to employees, training and getting processes established. While 
development and implementation are singular tasks with a finite timeline, Maintenance 
represents the ongoing requirements to ensure the system in question continues to function in the 
desired manner. 

5.1 Implement Process-based Management 

The SSA can best be described as an organization that relies heavily on the experience, 
dedication and hard work of long-tenured employees, perhaps too heavily. It utilizes a general 
management approach that focuses on institutional knowledge and budget-focused direct 
solutions for tasks. As a result, the organization has been unable to control quality, standardize 
roles and responsibilities, or identify operational risks. Without implementing a process-based 
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approach to management, SSA will continue to be unable to prevent unforeseeable factors, such 
as crew performance, from impacting their operations. 

Process-based management is an organizational approach that views a business as a collection of 
processes, managed to achieve a desired result (see Section 5.2). There are three stages to 
process-based management: 

1. Documentation of the process in order to achieve consistency and to communicate the 
process to all 

2. Analysis of performance in order to measure the organization’s progress and identify 
improvements in the process 

3. Implementing the improvements to make the process more effective in attaining the 
desired output. 

These stages also align with the continuous improvement cycle; Execute, Evaluate, Improve. 

The majority of the solutions identified through the team’s analysis (see Appendix B - RCA 
Solutions and Appendix C - General Observation Solutions) are addressed by one or more of the 
recommendations in this category. These recommendations are designed to put SSA on a path to 
process-based management. 

5.1.1 Recommendation i. Safety Management System 

It is strongly recommended that the SSA utilize the ISM Code as guidance to develop and 
implement an externally-audited safety management system (SMS) across the fleet. 

The International Safety Management (ISM) Code is an international standard for the safe 
operation of ships and for pollution prevention. It provides a framework for any maritime 
organization to develop an effective safety management system (SMS). 

The team’s root cause analyses and general observations identified a general lack of documented 
procedures, document control and the operational consistencies that generally accompany such 
practices. While a fully developed and properly implemented SMS will address this issue, 
including a large portion of the specific solutions identified in this report, it will also contribute 
greatly to the mitigation of potential future fleet incidents. 

5.1.1.1 Implementation Plan 

The study team believes an SMS would have a very high impact, perhaps the highest of the 
recommendations, on SSA operations. This impact is both short-term and long-tenn. However, 
it is also one of the most difficult of the final recommendations to implement properly with a 
high initial investment cost and considerable challenges involved. This is not something the 
SSA would be in a position to take on without external guidance and considerable commitment 
from leadership. See Section 4.1.6 for further details. 


Prerequisites 

Recommendation vii. - Health, Safety, Quality and Environmental 
Management 

Recommendation iv. Mission Statement and Performance Objectives 

Recommendation v. Strategic Plan 

Scope 

Phase 1 Development: document all vessel operating procedures 

Phase 2 Implementation: train crews and management 
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Phase 3 Maintenance: audit, continuous improvement 

Schedule 

Phase 1 Development: approximately one year 

Phase 2 Implementation: approximately six months 

Phase 3 Maintenance: ongoing 

Cost 

Phase 1 Development: $150,000 

Phase 2 Implementation: $100,000 

Phase 3 Maintenance: $50,000 annually 1 

Challenges 

Lack of existing inhouse experience with the ISM Code. 

Gaining acceptance during implementation. 

Proper implementation. 


1 - Maintenance costs are primarily for external audits on management and all vessels. This does 
not include the costs associated with Recommendation #HSQE. 

5.1.2 Recommendation ii. Quality Management System 

It is strongly recommended that the SSA develop and implement a quality management 
system (QMS) across the entire organization, preferably in concert with an SMS. 

A quality management system (QMS) is a collection of business processes focused on 
consistently meeting customer requirements and enhancing their satisfaction. Similar to an SMS, 
it is aligned with an organization’s vision. The ISO 9001 standard is a commonly utilized guide. 
Or, as explained in the general observations in Section 4.1.6, a QMS and SMS can be combined 
into one system for efficiency. 

5.1.2.1 Implementation Plan 1 

Similar to the implementation of a safety management system, the SSA would benefit greatly 
from a QMS, particularly if developed and maintained as a combined system with the SMS. As 
a QMS would include more varied departments within SSA (HR, IT, Ops, Engineering) it could 
require a slightly greater degree of effort than an SMS, taking a little longer to develop and 
implement. 


Prerequisites 

Recommendation vii. - Health, Safety, Quality and Environmental 
Management 

Recommendation iv. Mission Statement and Performance Objectives 

Recommendation v. Strategic Plan 

Scope 

Phase 1 Development: document all product delivery processes. 

Phase 2 Implementation: train employees and management. 

Phase 3 Maintenance: audit, continuous improvement. 

Schedule 

Phase 1 Development: approximately one year. 

Phase 2 Implementation: approximately six months. 
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Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $175,000. 

Phase 2 Implementation: $150,000. 

Phase 3 Maintenance: $25,000 annually 2 . 

Challenges 

Lack of existing inhouse experience with ISO programs. 

Gaining acceptance during implementation. 

Proper implementation. 


1 - For estimating purposes, the Implementation Plan is based on the assumption QMS would be 
developed as a stand-alone project and not in conjunction with an SMS. It is expected that a 
combined development and implementation would realize some cost savings. 


2 - Maintenance costs are primarily for external audits on management and all operations. This 
does not include the costs associated with Recommendation #HSQE. 

5.1.3 Recommendation iii. Learning Management System 

It is strongly recommended that the SSA source a Learning Management System (LMS) 
and implement it first with vessel crews. Based on successes and lessons learned it can then 
be expanded to other departments. 

A Learning Management System (LMS) is a software-based training and learning program that 
provides administration, documentation, tracking, reporting and delivery all in one system. 
Ideally, an LMS is web-based and provides employees unlimited access to training modules 
anywhere they have the right hardware; desktop computer, laptop, tablet or even a smartphone, 
with an internet connection. Training can be conducted in groups or individually via online 
content such as videos, prepared documents or externally li nk ed reading materials. Tests can be 
administered online with results reported immediately upon completion. 

The SSA has developed a considerable amount of training material over the years but none of it 
is formally catalogued; it is administered by individual departments and rarely tracked or 
reported. Developing either an SMS or QMS will also provide a large amount of training 
material. By placing this valuable information in an LMS the SSA will be able to identify 
training and learning gaps by utilizing real-time analytical data and reporting. 

5.1.3.1 Implementation Plan 1 

Sourcing the right LMS will require a considerable vetting effort. The development will also be 
considerable. It will include system design, content development and possibly equipment 
upgrades. Similar to the other process-based recommendations, the challenges of implementing 
an LMS are high but so is the reward. 


Prerequisites 

Recommendation iv. Mission Statement and Performance Objectives 

Recommendation v. Strategic Plan 

Scope 

Phase 1 Development: develop training matrix and content. 

Phase 2 Implementation: train managers on administration. 

Phase 3 Maintenance: audit, continuous improvement. 
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Schedule 

Phase 1 Development: approximately one year. 

Phase 2 Implementation: approximately six months to a year (seasonal). 

Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $100,000 2 . 

Phase 2 Implementation: $75,000. 

Phase 3 Maintenance: $40,000 3 . 

Challenges 

Lack of existing inhouse experience with LMS. 

Potential IT / equipment barriers. 

Proper implementation. 


1 - These estimates are assuming the LMS program would be administered by HR, in support of 
each department. 

2 - Does not include any possible equipment upgrades. 


3 - Based on an average of 500 employees annually. 

5.2 Establish a Vision 

Vision represents an aspirational purpose that the organization would like to achieve in the long 
run. The combination of a mission statement, perfonnance objectives and a strategic plan should 
direct an organization on how they are going to achieve their vision. A vision is crucial to any 
organization utilizing process-based management as it represents the desired result. 

It is leadership’s responsibility to the organization to clearly identify and communicate the 
vision. The following recommendations are intended to aid SSA’s leadership in the development 
of a vision for the organization and provide the necessary components to achieve it. 

5.2.1 Recommendation iv. Mission Statement and Performance Objectives 

It is strongly recommended that the SSA leadership adopt a mission statement and 
supporting performance objectives, communicate them to the employees and the general 
public, and identify the necessary metrics to measure progress against the performance 
objectives. 

A key element to the development of a vision, a mission statement identifies the fundamental 
purpose of the organization. This is intended to be an enduring statement that remains 
unchanged over time. The mission statement provides a guide for decision-making and unites 
the employees in aiming for a common target or direction. 

From time to time it is necessary to measure the progress the organization is making toward that 
target. By setting performance objectives, similar to milestones along the way, and measuring 
performance against those objectives the organization as a whole is able to measure their 
progress and detennine whether adjustments need to be made. 

5.2.1.1 Implementation Plan 

Arguably one of the easiest recommendations of the group to implement, a mission statement 
and performance objectives will have positive impacts almost immediately and, more 
importantly, will provide valuable guidance to several of the other recommendations in this 
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section. This is a process which the SSA’s leadership can engage almost immediately and 
complete in a short period of time with the only expense being for some guidance if deemed 
necessary and advertisement. 


Prerequisites 

None. 

Scope 

Phase 1 Development: develop a Mission Statement, Performance 

Objectives and Metrics. 

Phase 2 Implementation: Communicate to employees and public, 
implement metrics and track. 

Phase 3 Maintenance: Annual reviews against perfonnance objectives. 

Schedule 

Phase 1 Development: approximately two months. 

Phase 2 Implementation: approximately two months. 

Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $10,000. 

Phase 2 Implementation: $15,000. 

Phase 3 Maintenance: $0. 

Challenges 

None anticipated. 


5.2.2 Recommendation v. Strategic Plan 

It is strongly recommended that the SSA immediately begin a strategic planning process to 
include all aspects of the organization. 

A strategic plan answers how the organization is going to navigate what is ahead in order to 
attain the mission (long term) and performance objectives (short term). Strategic planning 
provides a framework for making long-term decisions, aligns goals across an organization, and 
helps to ensure the long-term availability of the resources critical to organizational success. 

Each of these have been problem areas for SSA. 

Strategic planning is not currently a part of the SSA culture. If we use Covey’s Urgent Important 
Matrix (Reference 12) to illustrate (Figure 11), Covey identifies four quadrants within which 
organizations or individuals operate based on two qualifying factors, Urgency and Importance: 

1. Crises - URGENT and IMPORTANT 

2. Goals and Planning - NON-URGENT and IMPORTANT 

3. Interruptions - URGENT and NOT IMPORTANT 

4. Distractions - NON-URGENT and NOT IMPORTANT 

Ideally, organizations want to spend the majority of their time in quadrant 2 setting goals and 
planning their path to attaining them while maintaining and enhancing their capability to operate 
more effectively in quadrant 1 when emergencies arise. Currently, the SSA operates primarily in 
quadrant 1, rarely spending any time in quadrant 2 identifying goals and planning. 
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Figure 11 The Covey Urgent Important Matrix 

Strategic planning is crucial to any organization that can quickly find itself buried in constant 
firefighting mode (quadrant 1) and never able to make any forward progress. It begins with 
developing a strategic plan for the organization, to include all departments and functions, but 
quickly infiltrates the culture and encourages all departments and then individuals to focus more 
on setting goals and planning to meet them. 

In reality, planning is never static. Circumstances change, and the plan must be adjusted and 
updated. The maintenance of a strategic plan is ongoing, year after year. 

The Association for Strategic Planning (ASP), a U.S.-based, non-profit professional association 
provides excellent guidance and resources. See Section 4.1.2 Strategic Planning for further 
details. 


5.2.2.1 Implementation Plan 

Moving from reactive to strategic management styles can be challenging, but becomes easier as 
it becomes an integral part of the corporate culture. It is recommended that the SSA seek 
external guidance in the initial strategic planning effort in order to learn the process, maintain 
momentum and keep the workload for inhouse resources manageable. Even with external 
resources, the strategic planning process requires constant involvement from the organization’s 
leadership. 


Prerequisites 

Recommendation iv. Mission Statement and Performance Objectives 

Scope 

Phase 1 Development: develop a 10-year+ strategic plan. 

Phase 2 Implementation: ensure all departments are aware of plan elements 
that relate to or affect them and actively enact them. 

Phase 3 Maintenance: perform annual reviews and make adjustments. 

Schedule 

Phase 1 Development: approximately six months. 

Phase 2 Implementation: approximately two to four months. 
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Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $100,000. 

Phase 2 Implementation: $25,000. 

Phase 3 Maintenance: $0. 

Challenges 

Experience and resources to develop a strategic plan. 

Proper implementation. 


5.3 Change Organizational Structure 

The SSA is currently structured in a fairly flat, functional (segregated into departments by 
function) organizational structure. While a functional structure is standard and effective for a 
maritime operation, some functions of departments and associated reporting lines are not clearly 
defined. It is surmised that the relatively flat nature of the organizational structure is a product of 
financial consideration over time. A flat structure is typically more efficient in many ways, in 
contrast with a more hierarchical structure, but it places additional strain on the senior 
executive(s) and, unless properly staffed, can result in losses which outweigh the financial 
efficiencies realized. 

Combined with alignment issues, the study team also identified a lack of key resources. This 
was particularly the case in Engineering and Maintenance. 

5.3.1 Recommendation vi. Engineering Resources 

It is strongly recommended that the SSA consider adding key positions in the engineering 
department and realign some conflicting responsibilities. See Figure 12, where positions 
highlighted in red indicate added positions. 

With a fleet of ten highly diverse vessels, geographically separated between Woods Hole, 
Hyannis and Fairhaven, operating on a very demanding schedule, it is not realistic to expect a 
single Port Engineer and single Assistant Port Engineer to provide all of the oversight and 
support functions that are needed. It is recommended that the SSA hire an additional Port 
Engineer and Assistant Port Engineer, dividing the fleet between the two teams. 

In addition to providing round-the-clock support to the vessels while they are in operation, 
planning and coordinating routine maintenance and repairs, and supervising vessel engineering 
personnel (see additional recommendations on this job function below), the Port Engineer is also 
responsible for the planning and management of major repairs and vessel overhauls. While this 
is an extensive workload for the resources allocated, operations support and overhaul planning 
and management are in constant conflict. For this reason, it is recommended that the position of 
Project Engineer be added to take on all responsibilities regarding the planning and management 
of major repairs, vessel overhauls and capital projects. While Port Engineers will provide 
valuable support and advice to the Project Engineer, their focus will remain on daily fleet 
operations. Likewise, the Project Engineer will not be involved in operations and therefore not 
be distracted from the demands of planning and managing projects. The Project Engineer should 
have a strong background in formal project management. One of their first tasks should be to 
develop a project management program and associated training for all project teams to follow. 
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Figure 12 Proposed engineering and maintenance management structure 

See Section 4.2.2 for further details. 

5.3.1.1 Implementation Plan 

While the study team has to acknowledge the considerable investment which this 
recommendation represents, it feels it is highly warranted. The expectations of the engineering 
department are daunting, and the resources provided are far below what could reasonably be 
expected to perform them and succeed. The Engineering department demonstrated a genuine 
desire and initiative to become more process-based but, of all departments, finds themselves 
perpetually in quadrant 1 (crises) when, as far as individual departments go, they benefit the 
most from planning. 

The greatest implementation challenge will be developing a reorganization plan which 
effectively reallocates roles and responsibilities and provides enough guidance as everyone 
learns their place and new ways of doing things. 
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Prerequisites 

Recommendation ix. Recruit Externally 

Scope 

Phase 1 Development: develop reorganization plan, job descriptions. 

Phase 2 Implementation: advertise positions, recruit and hire. 

Phase 3 Maintenance: monitor progress, make adjustments. 

Schedule 

Phase 1 Development: approximately one month. 

Phase 2 Implementation: approximately two to four months. 

Phase 3 Maintenance: ongoing monitoring and adjustments. 

Cost 

Phase 1 Development: $0. 

Phase 2 Implementation: $20,000. 

Phase 3 Maintenance: $452,200 annually 1 . 

Challenges 

Identification of qualified candidates who have experience and will 
embrace process-based management approach. 


1 - assuming a 33% burden rate 


5.3.2 Recommendation vii. Health, Safety, Quality and Environmental 
Management 

It strongly recommended that the SSA recruit and hire a Director of Health, Safety, 
Quality and Environmental Protection to oversee the development of process-based 
continuous improvement programs (SMS and QMS) as detailed in this report, manage 
their ongoing implementation and fulfill the duties of the Designated Person. 

The development, implementation and maintenance of the aforementioned process-based 
management systems will not be possible without a key manager with relevant experience being 
added to the organization. This position must have the authority to enforce the management 
systems and be outside the direct operational chain of command in order to avoid being 
conflicted with competing business interests. 

See Appendix D to identify this position (highlighted in green) within a recommended 
organizational chart for the SSA. 

See Section 4.1.6 for further details. 

5.3.2.1 Implementation Plan 

Two of the most impactful recommendations (SMS and QMS) contained within this section will 
require the addition of an HSQE position in order to achieve success. The implementation of 
this recommendation will prove more challenging than would be expected for most position 
creations. As a highly specialized area requiring experience with the development and 
management of effective systems, particular familiarity with the ISM Code and ISO in general, 
and the ability to effect change upon an organization, the pool of qualified candidates is small. 


Prerequisites 

None 

Scope 

Phase 1 Development: develop job description. 
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Phase 2 Implementation: advertise position, recruit and hire. 

Phase 3 Maintenance: monitor progress, make adjustments. 

Schedule 

Phase 1 Development: approximately one month. 

Phase 2 Implementation: approximately two to six months. 

Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $0. 

Phase 2 Implementation: $10,000. 

Phase 3 Maintenance: $169,000 annually 1 . 

Challenges 

Identification of qualified candidates with experience in a highly- 
specialized field. 


1 - assuming a 33% burden rate 


5.3.3 Recommendation viii. Vessel Operations 

It is strongly recommended that the SSA consider a realignment of the chain of command 
and roles and responsibilities among operations and engineering personnel, add a Chief 
Operating Officer (COO) and a Director of Marine Operations, and delete the Assistant 
Port Captain position. See Figure 14 with proposed positions highlighted in red. 

Two conditions were observed at the SSA which directly lead to this recommendation. 

First, there are communication issues, conflicts of interest and a general confusion of authority 
between the Vessel Operations and Engineering departments. This condition is created primarily 
by the fact that Chief Engineers on the vessels report directly to the Port Engineers and not to the 
vessel Master (Captain). The Engineering Department is currently considered a line function at 
the SSA with levels of authority not typically seen in maritime operations (see Figure 13). This 
frequently creates a conflict with the Vessel Operations department, typically the primary line 
function. Having personnel report to more than one chain of command creates short-circuits in 
communication and authority. 

Realigning the two departments where Vessel Operations remains the only line function and 
designating the Engineering department as a staff function to provide support to others, will 
firmly establish the vessel chain of command. 

Second, there is a lack of maritime operating experience at the executive/director level and the 
organization’s prime function’s (vessel operations) interests and priorities are not properly 
represented in the decision-making process. Currently, the SSA is organized as indicated in 
Figure 13 (the competing chains of command are highlighted in orange). This organization 
places considerable burden on the Operations Manager while simultaneously marginalizing 
vessel operations’ decision-making participation. 
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Figure 13 Current Vessel Operations and Engineering, competing chains of command 

Adding a Chief Operating Officer and a Director of Marine Operations will be necessary to both 
realign departments and ensure that the primary function of the SSA is properly and cohesively 
represented in decision-making. This proposed reorganization (see Figure 14) will also support 
and aid the change to process-based management while alleviating some of the burden on the 
General Manager by the current flat structure. 
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Figure 14 Proposed reorganization 

Incorporating all of the organizational recommendations contained in this section, the SSA 
would retain a functional organization that is less flat. See Appendix D for the current and final 
proposed management structures. 

5.3.3.1 Implementation Plan 

Implementation of these changes will undoubtedly be a challenge. Between realigning roles, 
responsibilities and lines of communication and identifying the best qualified candidates for the 
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roles proposed, it will require a carefully thought out plan of action and crystal-clear definition. 
But the benefits, in the opinion of the study team, are worth the effort and cost. 


Prerequisites 

None 

Scope 

Phase 1 Development: develop realignment plan, job descriptions. 

Phase 2 Implementation: advertise positions, recruit and hire. 

Phase 3 Maintenance: monitor progress, make adjustments. 

Schedule 

Phase 1 Development: approximately two months. 

Phase 2 Implementation: approximately two to six months. 

Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $10,000. 

Phase 2 Implementation: $20,000. 

Phase 3 Maintenance: $228,760 annually 1 . 

Challenges 

Identification of qualified candidates with experience in process-based 
management. 

Adjustment to shifting roles and responsibility, lines of communication. 


1 - assuming a 33% burden rate 


5.4 Change Management Recruitment and Performance Evaluation 

The SSA emphasizes promoting from within and with several significant retirements and 
departures of senior staff in just the past few years, the effects of this policy are becoming 
evident. 

Promoting from within is an admirable objective for any organization, but difficult to achieve 
success if not under the right circumstances. There are obvious advantages; motivation for the 
work force to easily visualize a career path, retained institutional knowledge, and maintaining 
cultural integrity are among them. But, while it promotes succession, its highly ineffective if the 
organization is not practicing succession planning. Unless certain requirements are met, the 
advantages are quickly outweighed by the disadvantages. 

If the organization does not utilize process-based management and succession planning, roles are 
not well-defined, and the candidate is forced to learn on the job or create their own process. The 
organization is also at risk of becoming isolated in their thinking and ways of doing things 
without external influence. Much of this is currently apparent at the SSA. 

For those new employees who do join the organization from the outside, they appear to run into 
barriers and resistance to change. They, or their ideas, are not readily accepted to be a part of the 
core group. 

Of equal importance, SSA leadership and management must be held accountable for the 
performance of the organization. SSA does not currently have an adequate system for measuring 
the perfonnance of its managers, which has resulted in a lack of accountability for their 
performance and the performance of their departments. 


Comprehensive Review of the Steamship Authority’s Operations 


113 


13 December 2018 





5.4.1 


Recommendation ix. External Recruitment 


It is strongly recommended that the SSA carefully weigh the advantages and disadvantages 
to promoting from within and increase efforts to recruit from outside the organization. 

If process-based management is embraced, then the policy of promoting from within gains value. 
But as the organization shifts to process-based strategies, external hires with experience in 
similar systems will aid the transition. Regardless, the many advantages to recruiting externally, 
particularly from the maritime and passenger vessel industry, should not be discounted or 
overlooked. 

5.4.1.1 Implementation Plan 

In competition with Recommendation iv. Mission Statement and Perfonnance Objectives, this 
recommendation may be the easiest to implement. Requiring no additional funding, a short 
timeline and very little in the way of policy change, the only potential barrier is internal 
resistance. 


Prerequisites 

None. 

Scope 

Phase 1 Development: develop policy change. 

Phase 2 Implementation: actively recruit using industry resources. 

Phase 3 Maintenance: continue and refine process. 

Schedule 

Phase 1 Development: approximately one week. 

Phase 2 Implementation: approximately one week. 

Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $0. 

Phase 2 Implementation: $0. 

Phase 3 Maintenance: $0. 

Challenges 

Internal resistance. 


5.4.2 Recommendation x. Management Performance Metrics / Accountability 

It is strongly recommended that the SSA develop performance metrics for key managers 
(based on the performance objectives developed under Recommendation iv. Mission 
Statement and Performance Objectives) and hold them accountable for progress achieved 
against them. 

It is critical for any high-perfonnance organization to be able to accurately and efficiently 
measure its own performance, so that bad practices can be identified and remediated, and good 
practices can be reinforced. The individuals responsible for leading and managing the 
organization must be evaluated based on the same perfonnance metrics, to ensure their goals are 
aligned with the organization’s. 

This is critical for two reasons. First, without adequate measurement and accountability, 
employees might have other priorities that cause them to make decisions that are not in the best 
interest of the organization. SSA is particularly susceptible to this problem. Its hero culture 
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rewards the appearance of heroics over strong, steady performance (see Section Y.Y.Y.). Its 
reliance on institutional knowledge disincentivizes knowledge sharing. Its culture of loyalty 
protects underperformers and holds high performers back from advancement. Instituting an 
objective system of perfonnance measurement and accountability combats all of these problems, 
while promoting a system of continuous improvement. 

Secondly, an effective system of accountability allows for efficient infonnation discovery 
between critical constituents of the organization. If a manager is held accountable for a 
performance metric, they will be incentivized to find ways to encourage their direct reports to 
help their department meet those metrics. If they find that they cannot meet the metrics with the 
resources they are provided, then they will be incentivized to communicate those resource needs 
to other organizational stakeholders who can provide them. This system of knowledge transfer is 
especially critical to large and highly dynamic organizations like SSA. 

5.4.2.1 Performance Metrics Tied to the Strategic Plan 

Performance metrics should be guided by a strategic plan (developing a Strategic Plan is another 
of our Final Recommendations; see Section 5.2.2.). Although the basic goals of an organization 
may be understood (e.g. safely transport passengers between the islands and the mainland), 
compromises between competing objectives will always be required (e.g. cost versus level of 
service). As is detailed in Section 4.3.8, these compromises can only be effectively navigated if 
there is a plan in place to guide management through them. Without a strategic plan, two 
departments may have competing objectives and work against each other, rather than working 
towards the same goal. One of the key functions of SSA leaders and managers is to make these 
hard decisions. A board-approved strategic plan should be used as a guide. 

The Board should be held accountable for the strategic plan, and management should be held 
accountable for meeting the goals of the strategic plan. To invoke this accountability, managers 
should be evaluated on objective performance metrics and goals that are directly tied to the 
objectives of the strategic plan. 

5.4.2.2 SMART Goals 

Goals are only useful if their completion is likely to correspond to organizational success. SSA 
management annual review goals were observed to be ineffective in this regard, due to a lack of 
clarity and measurability. 

The study team recommends that SSA changes how it writes its goals to dramatically improve 
their effectiveness. A recommended framework for designing performance metrics that are 
practical and effective is the SMART goals framework. The SMART acronym is the product of 
the following criteria: 

• Specific - Goals should be unambiguous and target specific areas. There should be no 
room for ambiguity about whether or not a goal has been achieved. 

• Measurable - You cannot manage what you cannot measure, so goals must be 
measurable. 

• Achievable - Stretch goals are good, but goals must be realistic and within the resource 
constraints of the organization, otherwise they are will be righteously ignored. 

• Relevant - Goals must be aligned with the overall goals of the organization. Otherwise, 
they are counter-productive. 

• Time-bound - Without a discreet time frame for when the goal must be achieved, the 
goal could be delayed into perpetuity, rendering it meaningless. 
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Accountability must start at the top. The annual performance evaluation of the general manager 
for the period ending in July 2018 was examined (Reference 3), and found to illustrate the lack 
of measurable performance metrics against which top SSA managers are evaluated. Utilizing the 
SMART goals framework, it is clear that even at the very top of the organization, the objectives 
on which management are evaluated do little to ensure accountability. 

For example, here is Goal Number 5 from the performance evaluation: 

Overseeing the timely completion of the mid-life refurbishment of the M/V Martha’s Vineyard 
and her redeployment into regular line sendee. 

The following observations are made: 

• Specific - The definitions of “overseeing” and “completion” are both highly ambiguous. 
What does overseeing mean? Does completion mean that the vessel has departed the 
shipyard? Or that every item on its mid-life refurbishment specification was 
accomplished to a high degree of quality? 

• Measurable - Because of the ambiguity of this goal, it is difficult or impossible to 
objectively measure. 

• Achievable - No direct issue; however, this goal was too easily achievable due to its lack 
of specificity, measurability, and time-boundedness. 

• Relevant - Because of its ambiguity, the success of the goal also does not necessarily 
translate to success for the organization. If the vessel is redeployed into service on time 
but is rife with quality issues, the goal could be considered accomplished despite the poor 
outcome. 

• Time-bound - The word “timely” is ambiguous. 

In hindsight, although one could argue that Goal Number 5 was met, the mid-life refurbishment 
of M/V Martha’s Vineyard was a failure in many ways. The project was over-budget and behind 
schedule. The vessel was rushed back into service, with extensive incomplete work, including 
issues that led to equipment failures and unplanned downtime. 

SMART goals help to prevent this ambiguity. A re-written Goal Number 5, utilizing the 
SMART framework, might look something like this: 

Goal as written: Overseeing the timely completion of the mid-life refurbishment of the M/V 
Martha’s Vineyard and her redeployment into regular line service. 

Revised goal: Complete the mid-life refurbishment of M/V Martha’s Vineyard within the 

constraints of a pre-specified project plan, including within budget, within 
SSA’s quality standards, and without disruption to planned service. 

The criteria are improved in the following regards: 

• Specific - Rather than being responsible for “overseeing” the project, the General 
Manager should be directly responsible for the actual completion of this project, due to 
its importance. The GM may also assign this responsibility to direct reports who are 
more directly involved with the project, but because the GM is responsible for hiring and 
managing those managers, the GM should also be held directly accountable. 

Specific budget, quality, and time requirements are added to remove ambiguity from 
whether the goal has been achieved. 
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• Measurable - The amount over or under budget can be measured. Assuming SSA has 
effective quality standards, these can be measured. Disruption to planned line service is a 
clear, binary measurement (there either is or is not disruption to planned service). 

• Achievable - The goal is achievable. 

• Relevant - Accomplishing this goal will result in a positive outcome for the organization. 

• Time-bound - This goal allows for the timeline to be set in advance, while holding the 
manager accountable for meeting the timeline that they set. 


5.4.2.3 Implementation Plan 


Prerequisites 

Recommendation v. Strategic Plan 

Scope 

Phase 1 Development: Perfonnance metric workshop to develop 
management perfonnance metrics that are directly tied to SSA’s Strategic 
Plan. Can be add-on to Strategic Plan development process. Utilize the 
SMART framework (or similar) for all future management performance 
goals. 

Phase 2 Implementation: Incorporate into annual reviews. 

Phase 3 Maintenance: During the annual review process, metrics should be 
reviewed to make sure they are incentivizing the right behavior (rewarding 
positive outcomes and penalizing underperfonnance). The responsibility 
of writing annual goals for each manager should be shared by that manager 
and their superior (they should both sign off on the goals the manager will 
be measured against for the following year). 

Schedule 

Phase 1 Development: Approximately 1-2 days for workshop. 

Performance metrics require Strategic Plan, although SMART goals can be 
developed immediately. 

Phase 2 Implementation: Performance metrics and SMART goals can be 
implemented immediately, at each annual review, although training the 
framework to managers will require 1-2 hours per manager. 

Phase 3 Maintenance: ongoing. 

Cost 

Phase 1 Development: $0 (or outsource to consultant for ~$20k). 

Phase 2 Implementation: $0 (or outsource to consultant for ~$20k). 

Phase 3 Maintenance: $0. 

Challenges 

Internal resistance to accountability. 


5.5 Final Summary of Recommendations 

The study team does not consider the casualties of 2018 that led to this investigation an anomaly 
but, rather, the beginning of a trend that is bound to repeat itself if systemic changes are not 
made. The operating and regulatory environments along with customer expectations and demand 
have changed dramatically in the past twenty years and the SSA has not adapted to these 
changes. 
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In summary, this report presents ten recommendations requiring considerable effort and 
commitment. Given the estimates provided, development and implementation of all ten 
recommendations would require an initial investment of approximately $lm, not taking into 
account the cost of internal efforts. The cost to maintain these improvements are an additional 
$lm every year, in addition to the current operating budget. However, this investment is 
inexpensive insurance against the type of incidents that plagued the SSA during 2018 and will 
result in a net cost reduction in the long-tenn. 

The environment which the SSA operates in has changed drastically over the past twenty years, 
but the SSA has not adapted to that changing environment. Based on the culmination of this 
comprehensive review, the study team does not view what occurred in 2018 as an anomaly, but 
rather the new norm, which will repeat itself in various manifestations if changes are not made. 
Progress under these circumstances will require strong leadership, significant change and adept 
management of that change. 
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Causal Factor Charts and Root Cause 
Map 


Comprehensive Review of the Steamship Authority’s Operations 


A-1 


13 December 2018 




MV Woods Hole: 15 March Grounding - Causal Factor Chart 


No established process, 
for crew to communicati 
training or operational 
concerns to SSA 
Management 



Main bridge and wing lever 
displays indicate station in 
control, and current throttle 
orders. 

PMC controls include a 'transfer 
lock' feature that would have 
prevented the wing from taking 
control. 



No established 
procedures or guidelines 
or maneuvering protocols 
regarding approaching a 
slip. 


Investigation of the 
incident was unable to 
determine the exact 
cause of the failure. The 
problem is more likely 
attributable to lack of 
operator familiarity with 
the system than control 
system failure. 




Crew has not received 
sufficient training on 
transfer control process 
for 'new' propulsion 
control system 



There is no established 
procedure for the transfer 
of controls for the 'new' 
propulsion control system 



Control is at the bridge 
wing. Crew had 
established control at the 
wing, either by over-riding 
the main bridge 'transfer 
lock' or by matching 
levers. Crew did not 
realize that the transfer 
had been completed 
successfully at the wing 
before reverting to the 
main bridge console 


Legend 


Main Line Step 


Process Step 
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MV Island Home Delayed Return to Service: Causal Factor Chart 



Management of 
Project not well 
defined 


SSA Project Mgr did 
not set expectations, 
or establish any 
mechanisms for QA/ 
QC for project 


The scope of this 
RCA is limited to 
post-award 
timeline and does 
not evaluate the 
planning process. 


Contract did not 
require a kick-off or 
progress meetings 



Island Home repair 


No communications 

contract awarded to 


between SSA and 

Senseco on 

—► 

shipyard from 

10/23/17 


contract award to 



vessel delivery 


There is no ability to track progress against a 
project schedule, specifically the critical path 



Contract did not 


Schedule 

require shipyard to 


development is not 

develop or maintain 


a standard element 

a schedule 


of SSA Project Mgmt 



The fact that the bow 
thruster refit was the 
critical path task for the 
project is based on 
correspondence. There 
is/was no project 
schedule to confirm this 


fact 



There is no project 
schedule identifying 
bow thruster task as 
the project critical 
path, or identifying 
bow thruster 
coupling as LLTM 


Responsibilities are 
unclear. Engine was 
not OFE, but SSA 
paid a change order 
to have the 
foundation re¬ 
worked 


Responsibility for 
the engineering 
and logistics 
associated with 
the project are 
complicated by 
lack of single 
source vendor 


Not known, Shipyard 
Responsibility 



Unknown 


Unknown. Contract 
change orders were 
issued/signed in July 
of 2018 and address 
costs but not 
schedule 



Engine Drawing 


No. Liquidated 
damages were 

provided to shipyard 


included in the 

was not correct 


contract but not 



charged to shipyard 



Shipyard does not 


Island Home 

order bow thruster 


delivered to Senseco 

coupling - long lead 

-► 

on 1/12/18, with 

time materials 


OFE bow thruster 

(LLTM) 


gears 


Bow thruster prime 


Bow thruster prime 
mover does not fit 

movers delivered 


on fabricated 

late to Senesco, 


foundation. 

arriving on 2/7/18 


foundation must be 



re-worked 




Work continues on 
Island Home 
through 2/21/18, 
scheduled shipyard 
completion date 


Inadequate 
monitoring and QC 
of shipyard activities 



Unclear. 
Management of 
shipyard project was 
team effort with 
loosely defined roles 
and responsibilities 



No formal testing 
process in place, 
over-reliance on 
USCG acceptance for 
quality assurance 


Testing 

requirements were 
provided in the 
specification, but no 
plan was developed 


Unknown, but 
engines were not 
started/tested until 
just prior to 
scheduled test 



System was not pre¬ 
tested. There was 
no test plan. 



There was a failure 
of the Basler engine 
controller for both 
bow thruster 
engines at engine 
start-up 


Remote control of 
the bow thruster 
does not work when 
tested for USCG 
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MV Martha's Vineyard 17 March Loss of Power: Causal Factor Chart 


The unexpected 
shutdown of the #2 
generator and associated 
blackout were not 
considered as part of the 
causal chain for this loss 
event, and were therefore 
not investigated in detail. 
Discussions of this 
shutdown with SSA 
engineering mgmt 
suggest that this 
shutdown was caused by 
improper configuration of 
the generator safety 
system automation, 
combined with unreliable 
generator winding 
temperature sensors. 


While dockside with the 
#2 generator online and 
the #3 generator in 
standby, the #2 generator 
shuts down, causing a 
blackout. #3 generator 
starts automatically and 
connects to the bus 


Fuel pressure gauge on 
pump discharge was not 
of the correct range, 
making it difficult to 
differentiate between a 
pump that is operating 
normally and a pump that 
is off. Also, there was no 
visual indicator that the 
pump was running in the 
machinery space 


Generator installation was 
inspected/commissioned 
by vendor who approved 
the installation. Issue 
may have been obscured 
by shrink-tubing applied 
to cable lug 



Cable not properly 
crimped by shipyard and/ 
or wrong crimp lug used 




High current +24VDC 
cable pulls out of bolted 
crimp lug at #3 generator 
starter and arcs on starter 
body, causing a generator 
shutdown, a fire, and a 
second blackout 



Vessel crew did not follow 


vessel start procedure 
when recovering from 
blackout. Procedure 
includes start of fuel 
transfer pump 


No established procedure 
for vessel recovery from 
blackout condition 



* 


Crew restarts plant, 
places two generators (#1 
and #2) online in parallel. 

Ventilation is restarted 
but fuel transfer pump is 
not 


Over reliance on 
institutional knowledge: 
No formal process or 
procedure in place to 
ensure completeness of 
incident investigations 




A thorough evaluation of 
the casualty was not 
performed 



Vessel returned to service 
with unrecognized 
operational limitations 


> 


Vessel cleared for return 
to service, based on 
availability of two working 
generators. Begins 
operating at ~ 1630 



critical system design/ 
operation changes 


The exact circumstances of how, when, and with what 
authorization the valve line-up of the fuel system was 
changed is not known due to conflicting reports by various 
SSA personnel. Not disputed: management did not 
authorize the change, and the change was not 
communicated to vessel crews (via verbal hand-over, status 
board, or standing orders, etc.) 




Watch processes do not 
force crew to monitor fuel 
service tank level. Service 
tank level is not included 
on oiler watch round 
sheets, vessels do not 
have log books where 
engineers record readings 


Fuel returns from the new 
generators and existing 
main engines directed to 
storage tank (not service 
tank) causing service tank 
level to drop much more 
rapidly when transfer 
pump not running. Crew 
and engineering mgmt 
not aware of the 
configuration change 


\ 



Engineering plans for 
vessel mid-life project 
indicate that all fuel 
returns are plumbed to 
the fuel service tank 
only. SSA indicated that 
these plans are 
incorrect, and actual 
arrangement allows 
returns to be directed to 
either the service tank or 
the storage tank, based 
on valve line-up. 


Fuel service tank level is 
displayed in bargraph 
form on vessel Alarm and 
Monitoring System 


Crew had sounded the 
fuel service tank in the 
morning, and found it to 
be full. Tank holds more 
than one day's fuel 
consumption 



STP used did not include 
testing of tank level 
alarms 



No formal testing plan / 
testing inadequate 



Fuel oil service tank level 
alarms not tested prior to 
return to service 



Fuel oil service tank 
alarms were not correctly 
configured by AMS 
vendor during system 
modification 



Legend 


Main Line Step 


Process Step 



Loss Step 


Notes 



Causal Factor 



Operation of two generators in parallel at all times would have 
prevented either generator shutdown from causing a blackout, 
thereby preventing the loss event 


Initial issue (cable lug 
issue on generator) 
caused switchboard 
damage that was not 
recognized until 20 
March, and resulted in 
vessel being out of service 
March 20-26 


Operation of two generators in parallel at all times would be 
detrimental to the generators due to prolonged periods of 
operation at severely light loads 



Other ferry operators have considered this question and 
determined that the value of the added redundancy outweighs 
the costs associated with additional maintenance that would 
be expected with such light loading 


Restoring power to main switchboard loads 
(within the capability of the emergency 
generator) was complicated by the fact that the 
vessel crew did not know how to back-feed 
power from the emergency switchboard to the 
main switchboard. No procedure for this 
operation had/has been written 
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MV Martha's Vineyard 5 May Loss of Power: Causal Factor Chart 


The level in the fuel 
service tank had gotten 
unusually low prior to the 
2x bunkering events. This 
may have contributed to 
the filters clogging earlier 
than is typical 



Watch processes do not force 
engineer on watch to ensure 
readings are taken accurately 
and/or consider whether or 
not the recorded readings are 
in the normal operating range 



There had been no 
planned maintenance 
item in system to replace 
the on-engine fuel filters, 
but this was not a factor, 
as prescribed interval for 
replacement is 500 hours, 
and engine had not 
reached that interval 
(~200 hours) 



Watch standers did not 
recognize the difference 
between 'normal' fuel oil 
pressure and critically low 
fuel oil pressure 




Final fuel pressure to the generator is normally logged 
on Oiler round sheets. Readings were recorded on 
May 2 nd -4 th , but no readings for final fuel pressure to 
the #1 generator were recorded for May 5 th . Oiler log 
sheets are not signed by Chief Engineer 



At 1900 on May 2 nd , Fuel pressure 
to the #1 (online) Generator is 100 
psig, which is inside the normal 
range. At 0500 on May 3 rd , it is 
recorded as 95 psig, which is 
below the normal range. This 
pressure drops slightly across two 
watches on May 3rd, and is 
recorded as 87 psig at 2000 that 
evening 




Vessel receives 1,700 
gallons of fuel at ~0930 
on May 4 th . Watch 
changes at mid day, then 
vessel receives another 
3,400 gallons of fuel. Fuel 
pressure to the #1 
Generator drops during 
the day, and is recorded 
as 50 psig at 1900 


Watch changes mid day 
on May 5 th . Fuel pressure 
to the #1 Generator 
continues dropping 


Incorrect specification of 
critical design 
parameters: PSTP utilized 
during COI testing cites 
incorrect set point, so 
system functioned as 
expected, but incorrectly 


PSTP utilized during 
COI is not signed or 
dated, SSA confirmed 
that the copy made 
available is the version 
used for COI testing 


party vendor in shipyard 
lacked sufficient controls 
to ensure alarm points 
were properly set 





AMS vendor set alarm 
point based on the 
requirements of the main 
engines, which operate at 
a lower fuel supply 
pressure 



This fact is 
contradicted by the 
June 2018 PSTP, which 
lists a higher pressure 
for main engine low 
fuel oil pressure 
alarms, but SSA 
verbally confirmed that 
the June 2018 PSTP is 
incorrect, not the 
narrative 


Set point for the AMS 
generator low fuel 
pressure alarm was set at 
25 psig, which is lower 
than the minimum 
operating pressure for 
these generators 


John Deere pressure 
alarm is intended to 
protect engine, set to 
annunciate "fuel supply 
pressure moderately/ 
extremely low" 



| 


#1 generator low fuel 
pressure alarm (Integral 
to John Deere safety 
-f> controls) Sounds. Chief 
engineer checks Racor 
fuel filters (which are not 
plugged) 


Legend 


Main Line Step 


Process Step 


♦ 


Loss Step 



CF < Causal Factor 


Other ferry operators 
have considered this 
question and determined 
that the value of the 
added redundancy 
outweighs the costs 
associated with additional 
maintenance associated 
with the light loading 


Operation of two 
generators in parallel at 
all times would be 
detrimental to the 
generators due to 
prolonged periods of 
operation at severely light 
loads 


Vessel chief engineer had 
only 30 seconds to react 


Vessel chief engineer was 
relatively new to the 
vessel, did not understand 
all details of the generator 
fuel system. Initial 
reaction was to check 
Racor fuel filters 



~30 Seconds 



Operation of two DGs in 
parallel at all times would 
have prevented the #2 
generator failure from 
affecting vessel 
operations 




John Deere filters are 10 
micron and 2 micron 
(Primary/Secondary), 
Racors are larger mesh 
size, larger volume flow 
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Design Problem 
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IT 


Reliability 

Program 

Problem 
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Output 





ill 


Misuse/Overload 
Problem 


Design Review/ 
Verification 
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Installation/ 

Fabrication 

Problem 


IT 


Permanent/ 
Returning Officers/ 
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Maintenance 
Program Design 


Design Input 

Issue GD 

• Design Scope 
Unclear GD 

• Design Input 
Obsolete GD 

• Design Input 
Incorrect GD 

• Necessary Design 
Input Not Available GD 

Design Output Issue CD 

• Design Output 
Unclear GD 

• Design Output 
Incorrect GD 

• Design Output 
Inconsistent GD 

• Design Input Not 
Addressed in 
Design Output GD 


No Independent 
Review/ 

Verification GD 
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/ lmplementation[15\ 
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Contract/ 
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Equipment 
Records 


- No Program GD 

Program 
Inadequacy CD 

• Critical Equipment/ 
System Not 
Identified GD 

• Inappropriate 
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Type Applied GD 

• Acceptance Criteria 
Inadequate GD 


Planned Maintenance 
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• Scheduling Issue cm 

• Scope Issue GD 
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• Scheduling Issue GD 
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• Event Specification 
IssueGD 

• Scheduling Issue GD 

• Scope IssueGD 

• Implementation 
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• Scheduling/Frequency 
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• Implementation IssueGD 


Equipment Design 
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Manufacturer's 
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Equipment 
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History GD 


Human Resource 
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• Review Skipped 
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Specifications 
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• Changes to 
Purchasing 
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• Ambiguous 
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• Communication 
with Pilot CD 


Duty/Watch 
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Appendix B Root Cause Analysis Solutions 


Comprehensive Review of the Steamship Authority’s Operations 
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13 December 2018 




RCAs Intermediate Solutions 

Recommendation 

Woods Hole Grounding 

Causal Factor #1: Over-reliance on institutional knowledge 

Perform a risk assessment for approaching and departing each terminal that identifies potential risks and provides a 
means to mitigate each identified risk. 

SMS 

13. Provide tools such as decision trees, job risk assessments and flow charts to aid decision making. Use unusual events as 
a learning and training tool. Train personnel to use the information they are provided. 

SMS 

C. Analyze the training needs for deck officers and establish training criteria and curriculum based on those needs. 

SMS, LMS 

Causal Factor #2: Insufficient training on new equipment 

Identify the hazards of the process and tasks associated with approaching a dock or pier under normal operations, non- 
routine operations and emergency operations. 

Causal Factor #3: No established procedure 

SMS 

^ • Develop a procedure for transfer control. Ensure all modes of operation and maintenance procedures are addressed. 

Causal Factor #4: No process to communicate a potential problem 

SMS 

a. Establish a simple means by which vessel personnel can provide suggestions and feedback to shore management. 
Develop event reporting guidelines and train vessel crews on the types of events that should be reported. 

SMS 

Island Home Delays 

Causal Factor #1: Management of project not fully defined 

Develop a Project Plan for the proper and full definition of any major repair project. Ensure that all parties participate 
in a kick-off meeting to review the plan and confirm its definition, 
k In developing a project plan, clearly define all responsibilities and authority. Communicate to all parties in order to 
confirm and address any conflicts. 

Inability to accurately track progress against a project schedule, specifically the critical 

Cdusdl Factor ft2i 

path 

Develop a policy to require that all projects over certain thresholds have a project schedule which identifies the critical 
path, the schedule is monitored and updated regularly. 

Causal Factor #3: Ongoing monitoring (Quality Control) of shipyard's activities was inadequate 

QMS 

QMS 

QMS 

3. Develop a policy or procedure identifying required levels of project monitoring, based on specific thresholds. 

Develop a policy identifying necessary qualifications required of project team and provide adequate training where 
identified. 

QMS 

QMS 

March 17th Blackout 


Causal Factor #1: The fuel pump was not restarted when restarting the vessel plant. 

a . The vessel should have a checklist for normal operation after startup. 

The crew should be trained to run through a checklist to ensure normal operation of the vessel after any start or restart 
k* of the vessel's plant. 

Causal Factor #2: A formal evaluation of the casualty was not performed. 

A standard operation procedure for conducting thorough incident investigations should be developed, to ensure all 

3. systems are operating normally, identify remedial actions, and immediately begin data collection that may be helpful in 
identifying any persistent, hidden issues. 

Ca sal Factor #3 Ganges t0 vesse l configuration were not adequately conveyed to management and 

circulated with crew. 

Modify watch processes and communication tools to ensure that all plant configuration changes are documented in a 

3 . way that is useful to vessel crews. For example, include 'fuel returns to storage tank' on a wipe board, along with 
information like '#1 pumps online/#2 pumps standby'. 

Management must have active control of how the vessel plants are operated. Develop policies that explain what plant 
|a. configuration changes are allowed at the discretion of the crew, what configuration changes are not allowed, and how 
all such changes are communicated and documented. 

Causal Factor #4: The Periodic Safety Test Procedure did not include tests it should have. 

SMS 

SMS, LMS 

SMS, HSQE 

SMS 

SMS, QMS 

a . The PSTP should be revised to include all tests required per USCG rules. If SSA does not possess sufficient engineering 
capability to ensure completeness and accuracy of the test document, external engineering resources should be used. 

Causal Factor #5: There was inadequate testing of the vessel prior to returning the vessel to service. 

SMS 


B-2 


RCAs 


Intermediate Solutions Recommendation 

SSA personnel or contractors acting as the owner's representative during shipyard or repair periods must be sufficiently 

involved with all vessel modifications to critical systems and equipment to monitor the quality of the work. Formalized 
a QMS 

test and inspection plans should be utilized to ensure all inspections and tests are thorough, and to provide a record of 

all inspections/tests. 


iv. May 5th Blackout 

Watch processes do not force engineer on watch to ensure readings are within normal 

Causal Factor #1: 

operating ranges. 

Change watch stander logging requirements to highlight critical plant parameters, and define their normal ranges, such 
that process deviations critical to operations are more readily identified. 

Management of third party vendor in shipyard lacked sufficient controls to ensure alarm 
Causal Factor #2: . 

points were properly set. 

SSA personnel acting as an owner's representative during shipyard or repair periods must be sufficiently involved with 
all vessel modifications to critical systems and equipment to monitor quality of work. When critical systems are 
modified, such as the installation of new generators, technical details like alarm setpoints should be reviewed and 
documented in technical specifications or commissioning check lists. SSA should require shipyards performing work on 
their vessels to submit detailed specifications to SSA for all work (including work done by subcontractors and equipment 
vendors), which SSA should review in detail. 

SSA should also require shipyards to submit detailed test procedures for proving functionality of all new or modified 
equipment, to be reviewed in detail and approved by SSA, and then carried out with an SSA representative witnessing 
the tests. 

Incorrect specification of critical design parameters, which resulted in an ineffective 

Causal Factor #3: 

Periodic Safety Test Procedure (PSTP). 

SSA engineering management should ensure the accuracy of critical documents like vessel periodic safety test 
procedures by establishing quality processes specific to those documents. Quality processes should designate 'owners' 
a responsible for such critical documents and provide for independent technical review when these documents are 
created or modified. Where SSA does not possess sufficient technical resources to perform this review, external 
contractors shall be utilized. 


SMS 


SMS, QMS 


QMS 


QMS 


v. Website Slowdown 

Causal Factor #1: Adequate load testing was not performed. 

a. Perform adequate load testing on the system prior to the next major event. 

i_ 

Determine an adequate frequency of load testing, identify major events and determine an adequate scope of testing. 

Causal Factor #2: Secondary and mirrored cloud-based website not utilized. 

a. The system design should be reviewed in order to determine the feasibility of attaining redundancy in the system. 

vi. Trip Alert Emails Blocked 

Causal Factor #1: System not adequately designed. 

■ The system design should be reviewed in order to determine a more reliable email distribution server and domain. 

Causal Factor #2: Outside vendor not utilized to analyze internal email list. 

a. Develop a procedure for establishing the testing requirements of the Trip Alert email system. 


vii. Connectivity Issues Due to Storm 

Causal Factor #1: System design allowed for a single-point-of-failure. 

The system design should be reviewed in order to determine a more reliable internet source in event of natural 
disasters or other interruptions of service. 


QMS 

QMS 


QMS 


QMS 


QMS 


QMS 
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Recommendation 


i. 


RCAs Root Cause Solutions 

Woods Hole Grounding 

Causal Factor#!: Over-reliance on institutional knowledge 


RC Solution 


Solicit comments and recommendations from operations and maintenance personnel regarding the proper function and 
operation of the transfer control system and resolve each comment. Utilize all available information and knowledge to 
establish vessel specific instructions regarding how to properly transfer control. Incorporate these instructions into a 
vessel specific training and familiarization program that addresses recency. 


Provide adequate staffing with the necessary knowledge and experience. 

Improve the level of detail in all training material. Provide vessel specific familiarization procedures that includes 
physical demonstration if competencies. 


Causal Factor #2: Insufficient training on new equipment 

Compile a list of vessel specific procedures and compare them to the existing list. Define and document any missing 
RC Solution p rocec | ures an d communicate them to fleet. 

Causal Factor #3: No established procedure 

Establish a system of document control that clearly indexes the current library of procedures. OEM manuals do not 
RC Solution replace vessel specific procedures. 

Causal Factor #4: No process to communicate a potential problem 

RC Solution Develop an enhanced reporting process to ensure risk recognition, share recognized hazards and gather data. 


ii. Island Home Delays 

Causal Factor #1: Management of project not fully defined 


RC Solution 

Develop a Project Plan template to be used for all projects meeting or exceeding certain thresholds, such as capital 
value or complexity. Establish a policy requiring a project plan and basic levels of documentation and communications 
commensurate with the specific project. 

Clearly define the roles and responsibilities of every team member involved in an overhaul project. Identify authority 
levels and decision-making protocols. Communicate these with all parties involved, including contractors and 

subcontractors. 

Causal Factor #2: 

Inability to accurately track progress against a project schedule, specifically the critical 
path 

Develop a policy requiring a project schedule with specific requirements (i.e. critical path identified) be developed for all 
RC Solution p ro j ec t s exceeding certain thresholds. Ensure that the project schedule is updated on a predetermined frequency, 
changes or delays are communicated to the project team and adjustments are made when necessary. 

Causal Factor #3: Ongoing monitoring (Quality Control) of shipyard's activities was inadequate 

RC Solution 

Develop a policy and supporting procedures which identify project monitoring requirements. Ensure that proper 
resources and personnel are provided to accomplish the necessary level of monitoring. 

SSA should develop a policy and supporting training to ensure all project team personnel are trained in project 
management disciplines and meet the proper qualifications for individual responsibilities as assigned. Designated 
project managers should receive formal project management training. 


iii. March 17th Blackout 

Causal Factor #1: The fuel pump was not restarted when restarting the vessel plant. 

__ „ , . Develop a comprehensive set of vessel policies/checklists to provide crew with direction on how to perform routine 

operations and respond to all likely casualty scenarios associated with each vessel. 

Make these policies/checklists available to all vessel crew in a place where they can access them while on watch. 

Train the vessel crew to utilize the procedures. Educate experienced crew, who may not feel the need to utilize such 
prescriptive procedures, on the impact that procedures, used as checklists, can have on error avoidance. 


Causal Factor #2: A formal evaluation of the casualty was not performed. 

Develop a formal and documented process that is automatically invoked when any vessel experiences a deviation from 
RC Solution normal operations that impacted, or could have impacted, vessel critical systems. The process output should examine 
and document the following: 

Investigation of the cause of the incident (or near miss) and recommendations for follow-up actions or 
policy/procedural changes to prevent reoccurrences (i.e. inspect other similar equipment in the fleet). 


SMS 

SMS 

LMS 

SMS 

SMS, HSQE 

SMS, HSQE 

QMS, ENGINEERING 
RESOURCES 

QMS, ENGINEERING 
RESOURCES 


QMS, ENGINEERING 
RESOURCES 

QMS, ENGINEERING 
RESOURCES 

LMS 

SMS 

SMS 

LMS 

SMS, HSQE 

SMS, HSQE 
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RCAs 

Root Cause Solutions 


Investigation of the effects of the incident, to ensure all possible consequences have been identified and corrected 
(i.e. identify damage which occurred as a result of the incident, which may not be evident during recovery from the 
incident). 

Recognizing the limitations of situational awareness in the aftermath of an incident, develop checklists to ensure 
vessel is restored to full normal operating condition before authorization to return to service is issued (e.g. restart 
fuel transfer pump). 

Causal Factor #3: 

Changes to the vessel configuration were not adequately conveyed to management and 
circulated with crew. 

RC Solution 

SSA should implement engineering management processes that: 

For all aspects of vessel plant configuration that may change during the vessel's service, provide a means of 
communicating current configuration to all watch-standers (such as a wipe board or magnetic status board). 

Train crews to always 'hand-over' configuration changes at watch turn over. 

SSA should implement engineering management processes that: 

Develop a set of standard operating procedures for each vessel that prescribes how vessel equipment is operated, 
deferring to manufacturer's guidelines and other references where appropriate. This document would include details 
such as system line-up, equipment rotation conventions, etc. 

Make these standard operating procedures available to all vessel crew in a place where they can access them while 
on watch. 

Train vessel crews on the details of the SOPs and the fact that deviations from the policies require explicit permission 
from engineering management. Ensure, as part of the training, that the SOPs are understood. 

Check back with vessel crews to ensure they are operating the vessels in accordance with the SOPs. 

Causal Factor #4: 

The Periodic Safety Test Procedure did not include tests it should have. 

RC Solution 

SSA should implement engineering management processes that: 

Identifies critical record plans and documents like PSTPs 

Forces individuals within the organization to consider how these documents may be impacted by system 
modifications during maintenance, repair, upgrade activities, and ensure that impacted documents are updated to 
reflect changes 

Requires review of updated documents by individuals other than those responsible for the update efforts, who have 
the technical ability to confirm accuracy and completeness of the changes. 

Where SSA lacks the expertise and/or bandwidth required to maintain this process, external resources should be 
applied. 

Causal Factor #5: 

There was inadequate testing of the vessel prior to returning the vessel to service. 

For all vital equipment/systems that are installed or modified during a shipyard or repair period, SSA should develop a 
detailed inspection and test plan. This test plan should be completed in conjunction with vendor and/or shipyard sign- 
RC Solution 0 f anc | regulatory testing of the equipment/systems. Inspection and test plans may be developed by the 

shipyard or vendors, but such plans should be reviewed and approved by SSA prior to any inspections or testing. Where 
SSA lacks the technical expertise to develop or approve inspection/test plans, external contractors should be utilized. 


iv. May 5th Blackout 

Watch processes do not force engineer on watch to ensure readings are within normal 

Causal Factor #1: K 6 6 

operating ranges. 

RC Solution Develop and implement policies and procedures related to engine room watch standers that collectively: 

Make the chief engineer on watch responsible for the safe operation of the vessel during their watch and prescribe 
the tasks that they must perform during their watch. 

Make the watch oiler responsible to the watch chief engineer for reporting any deviations from 'normal operations' 
observed in the plant, prescribe the tasks that they must perform during their watch. 

Designate an engineering manager as being responsible for the performance of engine department watch standers 
and empower that individual to control the training and assignment of individuals to watches. 

Implements vessel-specific logging processes that identify the critical parameters that watch standers must monitor 
and defines the normal and abnormal ranges of each. 


Recommendation 

SMS 

SMS 


SMS, LMS 


SMS, LMS 


SMS, QMS 


SMS 


SMS 
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RCAs 


Recommendation 


Root Cause Solutions 

Management of third party vendor in shipyard lacked sufficient controls to ensure alarm 

Causal Factor #2: 

points were properly set. 


For all vital equipment / systems that are installed or modified during a shipyard or repair period, SSA should develop a 
detailed inspection / test plan. These test plans should be completed in conjunction with vendor/shipyard sign-off of 

RC Solution the task and regulatory testing of the equipment/systems. Inspection/Test plans may be developed by the shipyard or 
vendors, but such plans should be reviewed prior to any inspections/testing. Where SSA lacks the technical expertise to 
develop or approve inspection/test plans, external contractors should be utilized. 

Incorrect specification of critical design parameters, which resulted in an ineffective 

Causal Factor #3: n , 

Periodic Safety Test Procedure (PSTP). 

Implement specific engineering quality processes that identify and manage policies, procedures, and documents 
associated with quality backstops like the annual automation tests associated with the USCG-required Periodic Safety 

RC Solution Test Procedures. These quality backstops are more critical to the safe operation of vessels than most other repair 
activities associated with annual shipyard and repair periods and require extra diligence and independent review to 

ensure accuracy. 

Additional resources and/or external contractor assistance should be employed to support the additional effort 
associated. 

Website Slowdown 

Causal Factor #1: Adequate load testing was not performed. 

Develop a procedure to ensure that adequate load testing is performed on the reservation system. Confirm a schedule 
RC Solution anc | sever jty 0 f tests. 

Causal Factor #2: Secondary and mirrored cloud-based website not utilized. 

RC Solution The design process should be administered to ensure mission critical systems meet established standards, such as 
redundancy. Quality control should be introduced to ensure established standards are met. 

Trip Alert Emails Blocked 

Causal Factor #1: System not adequately designed. 

RC Solution The design process should be administered to ensure mission critical systems meet established standards, such as 
reliability. Quality control should be introduced to ensure established standards are met. 

Causal Factor #2: Outside vendor not utilized to analyze internal email list. 

RC Solution Develop a procedure to ensure that adequate testing is performed on the Trip Alert email system. 

Connectivity Issues Due to Storm 

Causal Factor #1: System design allowed for a single-point-of-failure. 

RC Solution The design process should be administered to ensure mission critical systems meet established standards, such as 
redundancy. Quality control should be introduced to ensure established standards are met. 


QMS 


SMS 


QMS 


QMS 


QMS 


QMS 


QMS 
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GENERAL OBSERVATIONS 

SPECIFIC SOLUTIONS 

Recommendation 

Management Structure 

i. 

Mission Statement 

Develop and communicate a Mission Statement 

MISSION STATEMENT 



Develop performance objectives 

MISSION STATEMENT 

ii. 

Strategic Planning 

Develop a strategic plan 

STRATEGIC PLAN 




STRATEGIC PLAN, 



Implement management performance metrics 

ACCOUNTABILITY 

iii. 

Ops Structure 

Reinforce the chain of command on board the vessels 




Designate the engineering department as a staff function 

VESSEL OPS 



Increase maritime operations experience at the director or executive level 


iv. 

Staffing 

Conduct a management structure audit 

QMS 



Invest in management systems 

SMS, QMS, LMS 

V. 

Allocation of FIR 

Perform a management structure audit 

QMS 

vi. 

HSQE 

Develop and implement an ISM-Code compliant Safety Management System 

SMS, HSQE 

vii 

Hero Culture 

Change to a process-based culture 

SMS, QMS, LMS 

viii. 

Institutional Knowledge 

Document work processes 

SMS, QMS, LMS 




ENGINEERING 




RESOURCES, VESSEL 



Engage in succession planning 

OPS, RECRUITING, QMS 

ix. 

Tenure 

Recruit from outside to gain industry perspective 

RECRUITING 



Tie management performance to organizational performance 

ACCOUNTABILITY 

Fleet Maintenance 

i. 

Policies and Procedures 

Develop a set of company policies and procedures in a management system framework 

SMS 

ii. 

Engineering Resources 

Increase number of Port Engineers 

ENGINEERING 



Add a Project Engineer to oversee planning and project management of overhauls 

RESOURCES 



Segregate engineering operations support and fleet preservation functions 

SMS, ENGINEERING 

iii. 

EAMS 

Commit to proper implementation of new EAM/CMMS 

RESOURCES 




QMS, ENGINEERING 

iv. 

Project Planning 

Develop project planning and management processes 

RESOURCES 

V. 

Risk Assessment 

Risk assessment protocols 

SMS 



Implement a Safety Management System 

SMS, HSQE 



Designate a Risk Manager 

SMS, HSQE 

Vessel Operations 


Crew Training 

Develop a comprehensive training program 

LMS 

ii. 

ER Watch Processes 

Develop new engine room watch processes 

SMS 

iii. 

Triple Watch 

Develop a Fatigue Risk Management Plan 

SMS 

iv. 

SOPs 

Establish SOPs within a management system framework 

SMS 



Adopt a risk assessment process 

SMS 

V. 

Emergency Response 

Develop an Emergency Response Plan 

SMS 

vi. 

Sailing Schedules 

Develop a contingency plan for trip cancellations 

QMS 

vii. 

Weather cancelations 

Improve crew recency training 

SMS, LMS 



Evaluate the practice of replacing Able Bodied Seamen with Ordinary Seamen 

SMS, LMS 



Improve vessel reliabilty by implementing a quality management system 

QMS 

viii. 

Operational Metrics 

Establish operational KPMs for the fleet 

QMS, MISSION 

ix. 

Terminal Flow 

Perform a passenger flow analysis 

QMS 



Install signs, monitors, digital signage 

QMS 



Advisory radio broadcast system 

QMS 



Numbered lanes 

QMS, SMS 

IT Systems 

i. 

Project Planning 

Establish top 5 priorities for 2019 

STRATEGIC PLAN 



Draft an IT-specific strategic plan 

STRATEGIC PLAN 



Establish an IT help desk to track and prioritize IT issues 

QMS 

ii. 

Reservation System 

Perform a cost/benefit analysis on reservation system options 

STRATEGIC PLAN 

iii. 

Website Platform Mgmt 

Establish a website content manager 

QMS 



Establish regular communication with vendor iMarc 

QMS 



Develop an SEO strategy 

STRATEGIC PLAN, QMS 
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CURRENT SSA FUNCTIONAL MANAGEMENT STRUCTURE 
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PROPOSED SSA MANAGEMENT STRUCTURE 



Summary of Changes: 

1. Added HSQE function independent of chain of 
command 

2. Removed Engineering from direct chain of command, 
shifted from line function to staff 

3. Added Port Engineer and Assistant Port Engineer 
(Fleet B) 

4. Added Project Engineer 

5. Added Chief Operating Officer 

6. Added Director of Marine Ops 

7. Shifted Port Captain and Vessels under Director of 
Marine Ops 

8. Removed Assistant Port Captain 



Treasurer 


Director of HR 




Asst Treasurer 


Payroll 


Procurement 


Accounting 

Mgr 


Internal Audit 
Mgr 
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